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1.0 INTRODUCTION 


CARE III (Computer-Aided Reliability Estimation, version 4) is 
a computer program that predicts the unreliability of highly relia- 
ble reconfigurable fault-tolerant systems. Its predecessor CARE III, 
version 3, developed at Raytheon Co. under the direction of Dr. J. J. 
Stiffler, was delivered to the NASA Langley Research Center in 1982. 
Care III, version 3, was reviewed and modified by Boeing Computer 
Services under the direction of D. M. Rose yielding version 4 (refs. 

5 and 6 ) . 

Under NASA funding and direction Sequoia Systems, Inc. was to 
make enhancements to the mathematical model and computer program, 
version 4. The following are the enhancements made to CARE III 
and that are detailed m this report: 

1. CARE III conversion to FORTRAN 77; 

2. Examination and enhancement of the stiff Volterra integral 
equation solution; 

3. Examination and enhancement of the Kolmogorov forward equa- 
tion solution; 

4. Elimination of the oscillation in the module CARE3 func- 
tions; 

5. Consolidation of Boeing's version 4 and the enhanced CARE 
III code; 

6. Implementation of internally redundant modeling capability; 

7. Description of the ma^or CARE III data structures; 

8. Additional testing of user input values. 
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While implementing the enhancements listed above, several coding 
errors were found and corrected. Some were found m the original 

CARE III, version 3 code; some were found in version 4 due to the 

* ** 

conversion from the CDC 60 bit version to the VAX 32 bit version; 
and some were found in the modifications and additions made by Boeing 
Computer Services to yield version 4. These errors and corrections 
are throughly detailed in this report. 


* 

CDC is a Trademark of Control Data Corporation. 

** 

VAX is a Trademark of Digital Equipment Corporation. 
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2.0 CARE III CONVERSION TO FORTRAN 77 


The original CARE III version 4, VAX implementation code, was 
successfully compiled and loaded using Bell Laboratories' "Portable 

FORTRAN 77 Compiler", implemented on a VAX 11/750 under the Berkeley 

★ 

4.1 UNIX operating system. There were five types of necessary 
changes made to the routines in order to make them FORTRAN 77 stan- 
dard, and thus enable them to compile using this system. The five 
problem areas, which follow, will be addressed below: 

1) Seven character symbolic names, 

2) Illegal comparison of a non-character variable to a 
character string, 

3) Impossible conversion of a character string to a non- 
character variable, 

4) NAMELIST input, and 

5) Use of I/O units greater than 19. 


2.1 CODE CONVERSION CHANGES 


All seven character symbolic names were changed to six characters 
m CAREIN, COVRGE and CARE 3. The M4 macro processor was used to im- 
plement the name changes. Most variables could have been truncated 
to use the first six characters, but m most cases this would have 
yielded an even less meaningful name. Therefore, vowels were removed 
as much as possible. (See appendix A for all symbolic name equates 
including those converted in plotting programs CVGPLT and RELPLT. ) 


* 

UNIX is a Trademark of Bell Laboratories. 
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In all three mam programs, non-character variable TBASE was com- 
pared to Hollerith constants. Ibis comparison was changed to use an 
array containing the equivalent character strings. 

Example: 

IF (TBASE. EQ.4HHRS) FTHRS = FT was changed to: 

IF (TBASE. EQ. TBSAR (1) ) FTHRS = FT where TBSAR was defined as: 
DIMENSION TBSAR (4) 

DATA TBSAR/ ' HRS 'MINS 'SECS 'MSEC '/ 

In CARE3, real variable PRCODE was compared to Hollerith constants. 
PRCODE was declared CHARACTER* 4 m all subroutines containing COMMON 
/STEPCM/. 

In COVRGE, DOUBLE PRECISION debug variable ARNME was set to a 
HOLLERITH constant. It was changed to have a CHARACTER*8 declaration 
in all subroutines. 

In CAREIN, the FORTRAN 77 non-standard NAMELIST input method was 
replaced with list directed formatting. List directed formatting was 
chosen because it is very similar to the NAMELIST method. Both meth- 
ods allow for defaults to be used if a variable is not given a value 
in the input stream, and both use free format input. The NAMELIST 
method requires that the data variable names bo specified and equated 
to their desired values; therefore, order is not important. List di- 
rected formatting is order dependent because the data variable name 
is not specified m the input stream. To use a default for a data 
variable, an extra comma is required instead of a value. 
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noon 


Example: 


NAMELIST input: 

SFLTTYP NFTYPS=2, ALP=2*100.0, BET=2*1000. 0, DEL=100. 0,360.0, EPS-2*0.0, 
IDELF = 2*1, IEPSF = 2*1, PB=2*1.0, TRUNC=1.0E-5$ 

List directed formatting input: 

2, 100.0, 100.0, 1000.0, 1000.0, 100.0, 360.0,,, 0.0, 0.0, 1, 1,,, 

1.0, 1.0,,,, 1.0E-5/ 


Unfortunately, this method is more error prone due to the neces- 
sary placement of the extra commas. But with the use of the menu in- 
put preprocessor CARE3MENU (ref. 1) , this would not be a problem. 
Unfortunately, the current version of CARE3MENU runs solely under the 
VAX computers' VMS operating system and not under UNIX where list 
directed formatting is used. CARE3MENU would have to be changed to 
run under UNIX and to generate this new style of input, if a complete- 
ly FORTRAN 77 standard CARE III program is desired which includes the 
input preprocessor. 


The pertinent CAREIN code change follows: 


USE LIST DIRECTED FORMATTING INSTEAD OF NAMELISTS. 


$FLTTYP INPUT 

READ ( 7 , * , END=10 ) NPfYPS, 


(ALP (ITYP) , ITYP=1,NFTYPS) , 
(BET (ITYP) ,ITYP=1,NFTYPS) , 
(DEL (ITYP) ,ITYP=1,NFTYPS) , 
(RHO (ITYP) ,ITYP=1,NFTYPS) , 
(EPS (ITYP) , ITYP=1,NFTYPS) , 
(IDELF (ITYP) , ITYP=1,NFTYPS) , 
(IRHOF(ITYP) , ITYP=1,NFTYPS) , 
(IEPSF (ITYP) , ITYP=1,NFTYPS) , 
(PA (ITYP) ,ITYP=1,NFTYPS) , 
(PB (ITYP) ,ITYP=1,NFTYPS) , 
(C (ITYP) ,ITYP=1,NFTYPS) , 
DBLDF, TRUNC, CVPRNT, CVPLOT, 
IAXSCV, MARKOV, LGTMST 


C 



no on 


(CARE IN code change continued) 


C 


$STAGES INPUT 

READ (7,* ,END=10) NSTGES, 


(N ( I STG ) ,ISTG=1, NSTGES ) , 

(M (ISTG) ,ISTG=1, NSTGES) , 

(NSUB(ISTG) , ISTG=1 , NSTGES ) , 

(MSUB(ISTG) ,ISTG=1, NSTGES) , 

(ACSP(ISTG) , I STG=1, NSTGES) , 

((NOP (IQ, ISTG) , IQ=1, 5) , I STG=1, NSTGES) , 
(LC (ISTG) ,ISTG=1, NSTGES ) , 

IRLPCD, RLPLOT, IAXSRL 


$FLTCAT INPUT 

READ ( 7 , * , END=10 ) 


(NFCATS (ISTG) , I STG=1, NSTGES) , 

( ( JTYP (ICAT, ISTG) , ICAT=1, NFCATS (ISTG) ) 

,ISTG=1, NSTGES) , 

( ( JSBTYP ( ICAT , ISTG) , ICAT=1 , NFCATS (ISTG) ) 

,ISTG=1, NSTGES) , 

( (OMG (ICAT, ISTG) , ICAT=1 , NFCATS (ISTG) ) 

,ISTG=1, NSTGES) , 

( (RLM (ICAT, ISTG) ,ICAT=1, NFCATS (ISTG) ) 

,ISTG=1, NSTGES) , 

((OMGSUB( ICAT, ISTG) , ICAT=1, NFCATS (ISTG) ) 

, I STG=1, NSTGES) , 

((RLMSUB( ICAT, ISTG) , ICAT=1, NFCATS (ISTG) ) 

,ISTG=1, NSTGES) 


C 


$RNTIME INPUT 

READ (7,* ,END=10) Pr, NSTEPS, ITBASE, SYSFLG, CPLFLG, KWT, PSTRNC, 
QPTRNC, NPSBRN, CINDBG, CKDATA 


The four READ statements listed above contain all input parameters 
for the enhanced version of CARE III. (See section 7.2 and reference 
2 for a detailed description of all input parameters.) The order of 
the variables in the READ statements is the order that the variables 
must be specified when using the list directed input format. 

In CAREIN, I/O units 25 (file FT25F) and 26 (file FT26F) were 
changed to use units 17 and 18 - file names were left unchanged. 
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This change was necessary because this system allows only use of 
units 0 - 19. (Note that in the final enhanced version of CAREIN, 
file FT26F is no longer used.) 


In order to eliminate I/O problems, OPEN and REWIND statements 
were inserted into each of the main programs. The following lists 
are comprised of those statements contained in the final enhanced 
version of CARE III: 

CAREIN: 

OPEN ( UNI T= 3 , F I LE= ' COV IN', FORM= ' UNFORMATTED ' ,STATUS='NEW' ) 

OPEN (UN1T=4 ,FILE= ' RELIN ' ,FOKM= ' UNFORMATTED' ,STATUS= ' NEW' ) 

OPEN (UNIT=7 ,FILE= ' CREIN ' ,STATUS= ' OLD ' ) 

OPEN (UNIT=8,FILE= 'CREOUT ' , STATUS = 'NEW ) 

OPEN (UNIT=10,FILE='FT10F' ,STATUS='NEW' ) 

0PEN(UNIT=14,FI LE= ' BXYFL ' , FORM= ' UNFORMATTED ’ , STATUS= ' NEW ' ) 

OPEN (UNIT=15,FILE= ' PH5F ' ,FORM= ' UNFORMATTED ' ,STATUS= 'NEW ' ) 

OPEN (UNIT=17,FILE='FT25F' ,STATUS='NEW’ ) 

REWIND 3 
REWIND 4 
REWIND 7 
REWIND 8 
REWIND 10 
REWIND 14 
REWIND 15 
REWIND 17 


COVRGE: 

OPEN (UNIT=3,FILE=' COVIN ' , FORM= ' UNFORMATTED ' ,STATUS='OLD' ) 
OPEN (UN IT=7 ,FILE= ' CVGMTS ' ,FORM= ' UNFORMATTED ' ,STATUS='NEW' ) 
OPEN ( UN I T= 8 , F I LE = ' DBUG ' , STATUS = ' NEW ' ) 

OPEN (UNIT=9,FILE= ’ SNGFL ' ,FORM= ' UNFORMATTED ' , STATUS= ' NEW ' ) 

OPEN (UNIT=10,F1LE='DBLFL' ,FORM=' UNFORMATTED' , STATUS= ' NEW ' ) 

REWIND 3 

REWIND 7 

REWIND 8 

REWIND 9 

REWIND 10 
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CVGPLT : 


OPEN (UNIT= 3 , F I LE= ' COV I N ' , FORM= 1 UNFORMATTED ' ,STATUS='OLD' ) 
OPEN (UNIT= 4 , F I LL= ' PLF I LE ' , STATUS= ' UNKNOWN ' ) 

OPEN (UNIT= 9,FILE='SNGFL' ,FORM=' UNFORMATTED' ,STATUS='OLD' ) 
OPEN (UNIT=10,FILE= 'DBLFL' ,FORM= ’ UNFORMATTED ' , STATUS= ' OLD ' ) 
RPurwn 1 


REWIND 3 
REWIND 4 
REWIND 9 
REWIND 10 


CARE3: 

OPEN (UNIT=4 ,FILE= ' RELIH ' , FORM= ’ UNFORMATTED ' , STATUS= ' OLD ' ) 

OPEN (UNIT=7,FILE=’CVGMTS' ,FORM=' UNFORMATTED' ,STATUS='OLD' ) 

OPEN (UNIT=8 ,FILE= ' DBUG ' ,STATUS= ' UNKNOWN ' ) 

OPEN (UNIT=13,FILE= ' PRFNCS ' , STATUS= ' NEW' ) 

OPEN (UNIT=14,FILE='BXYFL' ,FORM=' UNFORMATTED' , STATUS =' UN KNOWN ' ) 
OPEN (UNIT=15,FILE= , FT15F' ,FORM= 'UNFORMATTED' , STATUS =' OLD ' ) 

OPEN (UNIT=16,FILE= 'PLTFL' r FORM= 'UNFORMATTED' , STATUS^ ' NEW ' ) 

OPEN (UNIT=17 ,FILE=' SCR17 ' , FORM= ' UNFORMATTED ' ,STATUS= ' NEW' ) 

OPEN (UNIT=18 ,FILE= ' INXY ' , FORM= ' UNFORMATrED ' ,STATUS='NEW' ) 

OPEN (UNIT=19 ,FILE= ’ IBXY ' ,FORM= ' UNFORMATTED ' ,STATUS= ' NEW' ) 

REWIND 4 

REWIND 7 

REWIND 8 

REWIND 13 

REWIND 14 

REWIND 15 

REWIND 16 

REWIND 17 

REWIND 18 

REWIND 19 


RELPLT : 

OPEN (UNIT= 2 , FILE= ' RELIN ' ,FORM= ' UNFORMATTED ' ,STATUS= 'OLD ' ) 
OPEN ( UNI T= 4,FILE='PLFILE' ,STATUS= ’ UNKNOWN ' ) 

OPEN (UNIT=16,FILE=' PLTFL ' , FORM= ' UNFORMATTED ' , STATUS =' OLD ' ) 
REWIND 2 
REWIND 4 
REWIND 16 


These file definitions correspond to the file definitions, on the 
PROGRAM statements, m the CDC version of CARE III. 


8 



2.2 CODE CONVERSION TESTING 


The original CARE III version 4, FORTRAN 77 programs were suc- 
cessfully executed on a VAX 11/750. The two test cases sent by NASA, 
with the original code, were rewritten using the list directed for- 
matting input method, described in section 2.1. Figures 2-1 and 2-5 
contain the two NASA input files along with the final portion of the 
corresponding output file for the first test case (figure 2-2) . Fig- 
ures 2-3 and 2-6 contain the two files executed on the VAX 11/750 
along with the final portion of their corresponding output files 
(figures 2-4 and 2-7) . 


SFLTTYP DEL ( 1) = 1.0E+1, 

DBLDF = 0.01, 

CVPRNT = .TRUE. 6 

$STAGES NSTGES = 2, 

N ( 1) = 2, 

M( 1) = 1, 

N ( 2) = 2, 

M( 2) = 1, 

IRLPCD = 4$ 

$FLTCAT NFCATS ( 1) =1, 

JTYP (1,1) = 1, 

OMG (1,1) = 1.0, 

RLM(l,i) = 1.0E-1, 

NFCATS ( 2) = 1, 

JTYP (1,2) = 1, 

OMG (1,2) = 1.0, 

RLM(1,2) = 1.0E-1$ 

$RNTIME FT = 1.0, 

SYSFLG = .TRUE., 

CPLFLG = .TRUE., 

CINDBG = . TRUE . $ 

CASER2A : TO TEST SYSTEM FAULT TREE - ’AND' TREE 

12 3 3 
3 A 1 2 

CRITICAL PAIR TREE - ALL PAIRS ARE CRITICAL 
14 5 5 
112 
2 3 4 

5 2 1 2 3 4 

Figure 2-1 - NASA NAMELIST Input File CASE1.DAT 
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NUMBER OF FAILED 

STAGES 

0 

1 

2 


UNRELIABILITY AT 

1.0000 HRS 

3. 1488777604E-03 
2.0517311059E-03 
X 


PERFECT COVERAGE 
UNRELIABILITY 
AT 1.0000 HRS 

O.OOOOOOOOOOE+OO 

0.0000000000E+00 

8.2009588368E-05 


TOTAL SYSTEM UNRELIABILITY AT 1.0000 HRS = 5. 2826185711E-03 


Figure 2-2 - NASA Generated Output from CASE1.DAT 


,,, 10.0 , ,,,,,,,, 0.01,, .TRUE./ 

2, 2, 2, 1, 1 ,,,,,,,,,,,,, 4/ 

1 , 1 , 1 , 1 ,,, 0 . 1 , 0.1 

1.0 ,,, .TRUE. , .TRUE. ,,, .TRUE./ 

CASER2A : TO TEST SYSTEM FAULT TREE - ’AND' TREE 
12 3 3 
3 A 1 2 

CRITICAL PAIR TREE - ALL PAIRS ARE CRITICAL 
14 5 5 
112 
2 3 4 

5 2 1 2 3 4 

Figure 2-3 - List Directed Format Input File CASE1.DAT 


NUMBER OF FAILED 

STAGES 

0 

1 

2 


UNRELIABILITY AT 

1.0000 HRS 

3. 1488784589e-03 
2. 0517315716e-03 
X 


PERFECT COVERAGE 
UNRELIABILITY 
AT 1.0000 HRS 

0. 0000000000e+00 
0 . 0000000000e+00 
8. 2009588368e-05 


TOTAL SYSTEM UNRELIABILITY AT 1.0000 HRS = 5. 2826195024e-03 


Figure 2-4 - FORTRAN 77 CASEl.DAT Output Results 


10 





SFLTTYP NFTYPS = 1 


ALP ( 1) 

= 1.0E+1, 

BET ( 1) 

= 1.0E+1, 

DEL ( 1) 

= 1.0E+1, 

RHO ( 1) 

= 1.0E+1, 

EPS( 1) 

= 2.0E+1, 

IDELF ( 

1) = 1 

IRHOF ( 

1) = 1 

IEPSF ( 

1) = 1 

PA( 1) 

= 1.0 

PB( 1) 

= 1.0 

C( 1) 

= 0.5 , 

DBLDF 

= 0.01 , 

CVPRNT 

= . TRUE . $ 


$STAGES NSTGES = 2 , 

N( 1) = 2 

M( 1) = 1 

N( 2) = 2 

M( 2) = 1 

IRLPCD =4 $ 

$FLTCAT NFCATS ( 1) = 1 , 

JTYP(1,1) = 1 , 

0MG(1,1) = 1.0 , 

RU4(1,1) = 1.0E-1, 

NFCATS ( 2) = 1 , 

JTYP (1# 2) = 1 , 

OMG(l, 2) = 1.0 , 

RLM (1# 2) = 1.0E-1$ 

$RNTIME FT = 1.0 , 

SYSFLG = .TRUE., 

CPLFLG = .TRUE., 

CINDBG = .TRUE.$ 

CASE2 : TO TEST SYSTEM FAULT TREE - ’AND' TREE 
12 3 3 
3 A 1 2 

CRITICAL PAIR TREE - ALL PAIRS CRITICAL 
14 5 5 
112 
2 3 4 

5 2 1 2 3 4 

Figure 2-5 - NASA NAMELIST Input File CASE2.DAT 
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TRUE./ 


1, 4*10.0, 20.0, 3*1, 2*1.0, 0.5, 0.01,, . 

3*2, 2*1, ,,,,,,,,,,,,4/ 

4*1, 2*1.0, 2*1. 0E-1 
1.0,,, .TRUE., .TRUE.,,, .TRUE./ 

CASE2 : TO TEST SYSTEM FAULT TREE - 'AND' TREE 
12 3 3 
3 A 1 2 

CRITICAL PAIR TREE - ALL PAIRS CRITICAL 
14 5 5 
112 
2 3 4 

5 2 1 2 3 4 

Figure 2-6 - List Directed Format Input File CASE2.DAT 


NUMBER OF FAILED 

STAGES 

0 

1 

2 


UNRELIABILITY AT 

1.0000 HRS 

8. 2743987441e-02 
7. 7691860497e-03 
X 


PERFECT COVERAGE 
UNRELIABLITY 
AT 1.0000 HRS 

0. OOOOOOOQOOe+OO 
0. 0000000000e+00 
8. 2009588368e-05 


TOTAL SYSTEM UNRELIABILITY AT 1.0000 HRS = 9. 0595178306e-02 


Figure 2-7 - FORTRAN 77 CASE2.DAT Output Results 


The two CASE1.DAT results agree to six decimal places. Sequoia's 
VAX 11/750 uses software floating point calculations, which may 
account for the slight discrepancy in the two results. The second 
test case sent by NASA, CASE2.DAT, did not have a corresponding out- 
put file. Therefore a comparison of the two results is not possible. 
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3.0 EXAMINATION AND ENHANCEMENT OF STIFF 
VOLTERRA INTEGRAL EQUATION SOLUTION 

Stiff integration methods were examined for solving the coverage 
Volterra integral equations. None were found applicable to the par- 
ticular type of functions contained in the CARE III coverage model 
(refs. 5 and 8) . 

An enhancement was made to the existing COVRGE integration method 
to reduce its stability problems mentioned in reference 9. Ibis en- 
hancement is detailed in section 3.3. 


3.1 GEAR'S METHOD 

A good deal of research was done into applying Gear's method to 
the COVRGE Volterra equations. It was determined that solving the 
Volterra equations, contained in module COVRGE, using Gear's method 
is basically impossible. Itie COVRGE Volterra equations cannot be 
converted to ordinary differential equations, which Gear's method 
requires (refs. 3 and 4), because the kernels of the Volterra equa- 
tions used in CARE III do not contain a finite number of non-zero 
derivatives. 
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3.2 SMOTHERMAN (PICARD) ITERATION 


Smotherman applied this method to a transient fault model (ref. 
7). CARE Ill's method of handling transients is different: 

- In Snotherman's Dissertation Defense, the series converged 

1 

since the ith term was bounded by (Xt) , with X = transient 
failure rate and t = mission duration, so that Xt was typi- 
cally very small. 

- In the CARE III coverage model, however, the ith term can be 
of the order of at with a the active-to-benign transition 
rate and t the fault recovery time. This at is not necessar- 
ily small, and the series convergent rate may be very slow 
indeed. 

It is not possible to apply the Smotherman (Picard) technique to 
the coverage model Volterra equations due to the slow series conver- 
gent rate. 

3.3 ADDITION OF ADAPTIVE STEP SIZE HALVING CAPABILITY 

In the CARE III Phase III report (ref. 9), J. J. Stiffler recom- 
mended that the coverage functions' adaptive step size be allowed 
to halve as well as double. This recommendation was made due to the 
fact that the coverage functions do not have monotonically decreasing 
derivatives. This modification was made to the coverage program. 

This modification basically entailed a change in the way that 
the step count per step size change was stored per function calcula- 
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0 


tion. For example: (NSTPAR(I) ,1=1,64) = 2 1 1 1 80 0 ... 

tells us that there were two steps using the initial step size, one 
step for the next three doublings of the step size and 80 steps using 
the final doubling. This method tested for the rate of change m the 
function to allow doubling when the points calculated became close 
enough, based on the DBLDF user input parameter. 

The new method also allows halving of the step size when the 
points become too far apart. This information is stored in NSTPAR 
as a negative step count. For example: (NSTPAR (I) ,1=1,64) = 

2 1 1 1 70 -9 -9 -9 -18 0 ... 0 tells us that after 

the fourth doubling, the step size halved three times for nine steps 
each halving, and then halved again for 18 steps at which point the 
function was effectively zero. In this method, the step size is not 
allowed to become less than the initial step size. 

This modification was inserted easily into COVRGE without any 
drastic structural change to the program. The changes were tested 
to confirm that the program yields the same results for non-stress 
test cases. The FORTRAN 77 CASE1.DAT results (see figure 2-4) were 
exactly the same using both methods. 

The change made to COVRGE enabling the adaptive integration step 
size to halve as well as double, was also tested using two stress 
test cases. The test cases were taken from the CARE III Phase III 
report (ref. 9). Test cases 3d and 3d'' were run. Figures 3-1 and 
3-2 contain the list directed input files used which correspond to 
these two test cases: 
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0.01,,. TRUE./ 


1, 3.6E6, 3.6E3, 0.0, 3.6E3, 3.6E4, 1, 1, 1,,,, 

1, 4, 2, 3, 2,, ,,,3/ 

1, 1, 1.0, 1.0E-5/ 

60.0, 64, 2, .TRUE., .TRUE./ 

****TEST CASE-T3D L. BRYANT 200CT83**** 

112 2 
2 0 1 

CRITICAL PAIR FAULT TREE 
14 5 5 
114 

5 2 1 2 3 4 

Figure 3-1 - List Directed Input File Test Case 3d 


1, 3.6E6, 3.6E3, 3.6E4, 3.6E3, 3.6E4, 1, 1, 1,,,, 0. 02, , .TRUE./ 
4 , 2, 3, 2,,,,, 3/ 

1, 1, 1.0, 1.0E-5/ 

60.0, 64, 2, .TRUE., .TRUE./ 

****TEST CASE-T3D" L. BRYANT 20OCT83**** 

112 2 
2 0 1 

CRITICAL PAIR FAULT TREE 
14 5 5 
114 

5 2 1 2 3 4 

Figure 3-2 - List Directed Input File Test Case 3d' ' 


Test case 3d was chosen because previously it was unable to run 
to completion due to accumulated error. It was hoped that the change 
to COVRGE would reduce the accumulated error, enabling it to run suc- 
cessfully. Ibis was not the case however. The change did reduce the 
number of oscillations m the problem functions, specifically those 

functions used to compute single fault function P . The integration 

a 

test for accumulated error of the kernel of function F must be less 

X 

than or equal to 1.0 (see pages 11 and 12 m ref. 9). When the pro- 
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gram was run with the doubling difference input parameter DBLDF spec- 
ified as 0.02, the integration error test result was 1.1322; with 
DBLDF specified as 0.01 (its minimum value) the integration result 
was 1.0217. Therefore this case was still unable to run to comple- 
tion. 

Test case 3d' ' was chosen as a second stress case to run mainly 
to be able to compare the final result with the Phase III result. 

Test case 3d'' (see figure 3-2) was run using various versions of 
COVRGE and CARE3. Table 3-1 lists those results: 


COVRGE Version CARE3 Version Final CARE3 Result 

* 

CDC COVRGE CDC CARE 3 2. 6467251658E-12 

VAX COVRGE version V.4 1.4192107775E-12 

** 

VAX COVHLV version V.3 1.4189854803E-12 

VAX COVHLV version V.4 1. 4189854803E-12 

* ** 

From ref. 9; COVHLV is module COVRGE containing 
the step size halving capability. 


Table 3-1 - Comparison of Final Result Using Various 

Versions of CARE III 
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The "halving step size" version of COVRGE effected the final 
result only slightly. Hie discrepancy between the original CDC 
version and the current VAX version results may be due to the numer- 
ous changes made to CARE III by Boeing Computer Services. 

From what little testing has been done using the modified COVRGE 
program, it appears as if the halving capability yields only a minor 
improvement. 
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4.0 EXAMINATION AND ENHANCEMENT OF 

KOLMOGOROV FORWARD EQUATION SOLUTION 

While reexamining the methods used to solve the CARE III Kolmo- 
gorov forward equation, it was determined that the original method 
of using NSTEPS equally spaced integration steps, in program CARE3, 
is valid only if FT (flight time) is short - for example, 10 hours. 
For a very large FT, all of the pertinent coverage information is 
contained within the first integration time step. Therefore to cor- 
rect this deficiency, an integration step size method similar to that 
used in program COVRGE was implemented. This also caused changes to 
be made in program COVRGE because the moment functions must be passed 
to CARE 3 at the same time points that the functions in CARE3 are to 
be calculated. 


4.1 SOFTWARE DESIGN CHANGES 

This section details the software design changes made to enable 
all reliability -model functions, m program CARE3, to be computed 
with increasing step sizes - similar to the method used in program 
COVRGE. It is not necessary to include a "halving step size capa- 
bility" to module CARE3. The rational for using increasing step 
sizes is to start with a small step size required by the coverage- 
model functions and gradually increase to a large enough step size 
capable of reaching FT in 64 or less steps. 
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The design change that had to be addressed was how best to in- 
crease accuracy when solving the Kolmogorov forward equation, espe- 
cially as FT (user specified flight or operating time) becomes large 
relative to the coverage-model functions. The change had to be made 
without completely restructuring CARE3 and without greatly increasing 
execution time and storage requirements. This method, m combination 
with a more sophisticated integration routine, yields greater accu- 
racy when computing the Q^(t) vectors. All reliability-model func- 
tions computed using the first three moments of the coverage-model 
functions, i.e. all non-fault-vector-dependent functions, are comput- 
ed with a greater concentration of points at the beginning of the 
time range where coverage is the gating factor. The details of the 
software design change follow. 

4.1.1 REVIEW OF ORIGINAL SOFTWARE DESIGN 

In the original version of CARE3, all reliability-model func- 
tions were computed at equal time steps, determined by the ratio 
*FT / NSTEPS 1 . It is at these same times that the moments of the 
coverage-model functions were passed to CARE 3. (See pg. 36 in ref. 

8 for an explanation of the interface between CQVRGE and CARE3 using 
the first three moments of the coverage-model functions.) As FT in- 
creases, fewer and fewer of the function values passed to CARE 3 are 
unique since the first step often contains the entire coverage-model 
function. For example, if TZERO (time at which the corresponding 
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probability function became effectively zero) equals 15 minutes and 
FT equals 60 minutes, then 17 unique moment function values would be 
passed to CARE3. The function value at time zero, 15 values at mul- 
tiples of time 0.9375 minutes, and the final function value would be 
passed leaving 'NSTEPS +1 -17* points passed that equal the 17th 
point value. The final function value is repeated to fill the re- 
mainder of the array passed to CARE3. If NSTEPS equals 64, then 48 
duplicate points would be passed to CARE 3. Table 4-1 shows NUVL 
(number of unique values passed to CARE3) as FT increases. 


TZERO 

FT 

RELSTP 

NUVL 


15 min. 

1 hr. 

0.9375 min. 

17 

(see text above) 

15 min. 

10 hr. 

9.375 mm. 

3 J 

l.e. value at time 
> zero, 9.375 mm., 

1 and the final value 

15 mm. 

100 hr. 

93.75 mm. 

2 , 

j 

j i.e. value at 

15 min. 

1000 hr. 

937.5 mm. 

2 ! 

> time 0.0 and 

15 min. 

5000 hr. 

4687.5 mm. 

2 1 

the final value. 


where NUVL = TZERO/RELSTP + 1, RELSTP = FT/NSTEPS, and NSTEPS = 64. 


Table 4-1 - Number of Unique Coverage Values Passed to 

CARE 3 as FT Increases (Using Equal Step Sizes) 


Table 4-1 shows that as FT increases, the entire coverage-model func- 
tion is contained in the first RELSTP. It is represented as only two 
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values for CARE3 to work with when computing the convolution of the 
first three moments of the coverage-model function with the reliabil- 
ity-model weight function f(t) (see ref. 8, pg.42). As can be seen, 
FT does not have to become very large before this happens. 

4.1.2 ENHANCED SOFTWARE DESIGN 

In the enhanced version, the coverage functions are passed to 
CARE 3 at time values determined by a "logarithmic time steps" method. 
This method is based on an initial coverage step size (CVGSTP) , which 
is used for a number of steps, determined by the program, and then 
doubled. This doubled CVGSTP is then used for the same number of 
steps as the initial CVGSTP and then doubled again. This process 
continues until FT is reached because FT was the maximum time value 
requested for the current run. 

4. 1.2.1 COMPUTING THE DOUBLING PARAMETERS 

Flight time can be described in terms of the doubling function 
using CVGSTP, NPERST and NDUB as follows: 

0 1 NDUB 

FT = NPERST*CVGSTP*2 + NPERST* CVGSTP* 2 +...+ NPERST*CVGSTP*2 

This equation can be simplified to the following one. 

NDUB+1 

FT = NPERST * CVGSTP * (2 - 1) 
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The following list describes the variables in this equation: 


1) FT 


user defined flight or operating time for which 
the system is to be assessed. 


2) NPERST 


number of steps to use per each step size before 
doubling occurs. 


3) CVGSTP 


initial coverage step size. 


4) NDUB 


number of times CVGSTP must be doubled in order 
to reach FT. 


The following constraints must be placed on NPERST, NDUB and 

CVGSTP when solving this "logarithmic time steps" equation. 

• Let NSTEPS = NPERST * (NDUB+1) . When varying NPERST and NDUB 
in the above equation - to solve for CVGSTP - NSTEPS must be 
computed less than or equal to 64. This restriction is neces- 
sary because module CARE3 uses a maximun of 64 steps for all 
function calculations. 

• CVGSTP must be computed based on the behavior of the cover- 
age functions m the current run. The most appropriate CVGSTP 
would be one based on the coverage-model probability function 
with the shortest time range. But this value would not neces- 
sarily yield valid integer values for NPERST and NDUB if plug- 
ged into the "logarithmic time steps" equation. 


Because NSTEPS is still directly linked to the number of steps 
used to compute all the reliability functions m CARE3, NSTEPS con- 
tinues to be a user specified parameter. NSTEPS is redefined as the 
minimum number of steps (not equally spaced) to be used in the COVRGE 
and CARE 3 programs. If the original method of equally spaced time 
steps is desired, a new logical input parameter LGTMST (logarithmic 
time steps) may be input as .FALSE, in the input file. If .FALSE, 
is input for LGTMST, NSTEPS will be defined as it was originally. 
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A preliminary coverage step size (PCVSTP) is calculated as the 
minimun TZERO value of all the coverage-model probability functions 
divided by 64. PCVSTP is thus based entirely on the behavior of the 
coverage functions in the current run. Because PCVSTP would not nec- 
essarily be a valid solution to the "logarithmic time steps" equation 
PCVSTP is used as a constraint when solving for CVGSTP. Because 
PCVSTP is the smallest appropriate initial coverage step size, PCVSTP 
must be used as the lower bound when computing CVGSTP. 

4. 1.2. 2 DETERMINING A VALID SET OF CVGSTP'S 

The "logarithmic time steps" equation can be rearranged, in order 
to solve for CVGSTP, as follows: 

NDUB+1 

FT / CVGSTP = NPERST * (2 - 1) . 

FT can be eliminated from the equation, thus making the solution in- 
dependent of FT, by introducing a new variable NCVSTP (number of in- 
itial CVGSTP’ s) . NCVSTP equals the ratio 'FT / CVGSTP' in the equa- 
tion, as shown. below. Module COVRGE computes a set of NCVSTP values 
by iterating NPERST and NDUB when solving for NCVSTP in this equation 

NDUB+1 

NCVSTP = NPERST * (2 - 1) . 

Table 4-2 lists the possible values for NPERST and NDUB for 
NSTEPS values between 60 and 64. The final column NCVSTP (number of 
initial CVGSTP's) , given NPERST and NDUB, will be used to determine 
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the best CVGSTP for the current coverage run. Note that the greatest 
expanse in the table occurs when ’ NPERST =1'. If the NSTEPS range 
is expanded to include a minimum value of 34, the table expands to a 
maximun of 63 solutions (not shown) . A minimum value of 34 for 
NSTEPS assures the maximum number of choices for NCVSTP because the 
following two vector solutions, in the form (NPERST, NDUB, NSTEPS) , 
yield the same NCVSTP value: (1, 32, 33) = (2, 31, 64). 


NPERST 

NDUB 

NSTEPS 

NCVSTP 

1 

63 

64 

.184467441E+20 

1 

62 

63 

. 922337204E+19 

1 

61 

62 

.461168602E+19 

1 

60 

61 

. 230584301E+19 

1 

59 

60 

. 115292150E+19 

2 

31 

64 

. 858993459E+10 

2 

30 

62 

.429496730E+10 

2 

29 

60 

. 214748365E+10 

3 

20 

63 

6291453 

3 

19 

60 

3145725 

4 

15 

64 

262140 

4 

14 

60 

131068 

5 

11 

60 

20475 

6 

9 

60 

6138 

7 

8 

63 

3577 

8 

7 

64 

2040 

9 

6 

63 

1143 

10 

5 

60 

630 

12 

4 

60 

372 

16 

3 

64 

240 

21 

2 

63 

147 

32 

1 

64 

96 

64 

0 

64 

64 

Table 4-2 

- (NPERST, NDUB, NSTEPS) 
Independent of FT 

Vector Solutions 
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4. 1.2. 3 SELECTING THE MOST VALID CVGSTP 


Now that a list of possible choices exist for CVGSTP, because 
FT and NCVSTP values are known and 'CVGSTP = FT / NCVSTP', the final 
step is to choose the most appropriate CVGSTP based on the behavior 
of the coverage functions m the current run. FT is divided by the 
preliminary step size (PCVSTP) and the result is compared to the 
NCVSTP choices. One NCVSTP is chosen such tliat it is the largest 
value less than or equal to 'FT / PCVSTP'. Choosing NCVSTP in this 
manner guarantees that CVGSTP will be greater than or equal to PCVSTP. 
CVGSTP can then be computed as 'FT / NCVSTP' , and NPERST and NDUB 
values retrieved from the table. 

All moments of the coverage-model functions are passed to CARE3 
at times based on CVGSTP, NPERST and NDUB. The only additional in- 
formation that must be passed to CARE 3 are these three values: 

(CVGSTP, NPERST, NDt©) , termed the doubling vector, which will enable 
module CARE3 to generate the time values which correspond to the 
passed coverage function values. 

4.1.3 RESULTS OF ENHANCED SOFTWARE DESIGN 

Table 4-3 shows the enhanced version's NUVL's versus the origin- 
al version of COVRGE's NUVL's for a coverage function with a TZERO 
value of 15 minutes and NSTEPS specified as 60 (minimum) : 


26 



FT 

(hr.) 

NPERST 

NDUB 

NSTEPS 

CVGSTP 

(nun.) 

ENHANCED 

NUVL 

ORIGINAL 

NUVL 

1 

16 

3 

64 

0.250 

36 

17 

10 

8 

7 

64 

0.294 

24 

3 

100 

5 

11 

60 

0.293 

19 

2 

1000 

4 

14 

60 

0.458 

14 

2 

5000 

4 

15 

64 

1.144 

10 

2 

80000 

3 

20 

63 

0.763 

10 

2 


Table 4-3 - Increased Number of Unique Coverage Values 

with Enhanced COVRGE 


NPERST, NDUB and CVGSTP were computed using the method described 
above. Notice that using this method does not necessarily lead to 
fewer unique points as FT increases. Tins is because 'FT / PCVSTP' 
must fall very close to one of the possible NCVSTP values (see Table 
4-2) m order to get CVGSTP as close to PCVSTP as possible. The 5000 
hour and 80,000 hour cases both yield 10 unique function values be- 
fore TZERO is reached because the 5000 hour CVGSTP was larger than 
the 80,000 hour one. If NSTEPS was input as 50 (minimum), the 5000 
hour CVGSTP would equal 0.382 minutes with the solution vector 
(NPERST, NDUB, NSTEPS) = (3, 17, 54) and NUVL would increase to 13. 
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This example shows what will happen if NSTEPS is input as a value 
less than 64. CV3STP will approach PCVSTP, NUVL will increase and 
NSTEPS will decrease. Itiere is a trade-off between how many unique 
coverage function values to pass to CARE3 and flow many time steps to 
use in computing the reliability functions in module CARE3. NSTEPS 
is still set to a default value of 50, which appears to satisfy 
COVRGE and CARE 3 requirements for the best accuracy possible. 

4.2 CODE CHANGES 

Hie necessary code changes for this enhancement were kept to a 
minimum. The basic structure of both the COVRGE and CARE3 programs 
was not changed. The code that calculates the coverage-model proba- 
bility functions was not modified. The "logarithmic time steps" 
method merely determines which corresponding moment function values 
to pass to CARE 3. 

Five new routines were added to COVRGE: 

1) CIDXDV - compute index of doubling vector, 

2) CKMNTS - check times of saved moment functions, 

3) GNDBLV - generate array of possible doubling vector 

solutions, 

4) GNLGrM - generate time array based on doubling parameters, 

5) QDINTR - quadratic interpolation. 

Routines FILSNG and FILDBL were expanded to fill the moment arrays 
at times based on the chosen doubling vector. 
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In CARE3, three new routines were also added: 

1) CUBINT - Simpson's rule integration based on nonequally 

spaced abscissas, 

2) FTMIDX - find time index, 

3) RETFVL - retrieve weight function value, 

SUBROUTINE UNRELQ was modified to use CUBINT instead of FINTGT; 
SUBROUTINE ABCST was modified to compute the a(t), b(t) and c(t) 
coefficients based on the initial step size CW3STP at predetermined 
times instead of at multiples of the reliability step size. 


The main change in the CARE3 program was the computation of all 

functions at times equivalent to the passed moments of the coverage 

functions. These times are computed using the passed doubling vector 

(CVGSTP, NPERST , NDUB) and stored m TWAR (65) , which is located in 

COMMON /STEPCM/. When computing functions H , H_, H , H , h , h , 

L B B DPT DF F 

the reliability step size (RELSTP) was replaced by CVGSTP. (See Table 
1, pp. 40-43 in ref. 8 for a description of the "H" functions.) And 
the integration method used to solve the Kolmogorov forward equation, 
which is comprised of the aforementioned functions, was changed to 
use a modified Simpson's rule, based on non-equally spaced abscissas. 


More sophisticated integration routines, such as those based on 
Runge-Kutta formulas would not add accuracy to the calculation used 
to compute the "Q" vectors (see pg. 53 in ref. 5 and pg. 35 in ref. 8 
for the definition of Q^(t)). Excessive interpolations, within the 
various stored functions that comprise the Q^(t) definition, would be 
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required. Hie modified Simpson's rule integration routine uses the 
exact stored function values at non-equally spaced abscissas and thus 
does not require interpolations. That is why it was chosen over a 
Runge-Kutta metnod or a method that uses adaptive step sizes. There 
are too many preevaluated functions that comprise the calculation of 
the "Q" vectors to be able to use a numerical method that chooses the 
independent variable as it progresses. 

4.3 TESTING OF THE CODE CHANGES 

The coding of the design change to the Kolmogorov forward equa- 
tion calculation, detailed m section 4.1, was debugged using Example 
Problem 5, contained m reference 1, with a modification to the PB 
input parameter m the intermittent fault type - set to 0.99 instead 
of 0.1. (The only reason for the change was that the test case was 
originally presented to Sequoia Systems, Inc. with 'PB = 0.99'.) A 
bug was found m the original code while debugging this change and 
will be discussed in this section. 

TVie Example Problem 5 test case was chosen to aid in debugging 
the enhancement because of its varied fault types. In this enhanced 
method for solving the Kolmogorov equation, the unequal time steps 
used for solving all functions are based on the coverage functions' 
time maximums (TZERO points) . This test case contained coverage 
functions with greatly varying TZERO values: 9.28E-6 hours to FT (10 
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hours) . Therefore it was an excellent test case for debugging the 
generation of the doubling vector (CVGSTP, NPERST, NDtJB) , described 
m section 4.1, and its effect on the calculation of the failed state 


probabilities Q 


l 


(t). 


The calculation of the weight function f at time zero, used in 
the convolutional approximation (see Table 1 in ref. 8) , was discov- 
ered to be incorrect. The error occurs mainly when the w parameter, 
in the Weibull failure density function, is defined to be other that 

1.0. The f(0) correction eliminates oscillation in the H (X = L, 

X 

B, B, and DPT) and h (X = DF and F) functions, which directly af- 

X 

fects the accuracy of the failed state probabilities Q.(t). 


The error m the calculation of f (0) , using 


- 1 

(■> o> 

xi xi 


X (0 ) = <*» X 0 occurs when 0MGA(ICAT, ISTG) is less than 


XI XI XI 

or equal to 1.0. Function f (0) is used extensively in calculating 
the a(t), b(t) and c(t) coefficients used in the convolution of the 
reliability-model function with the first three moments of the cov- 
erage-model functions. Therefore, in the original version of CARE 
III, if CMGA (ICAT, ISTG) is less than or equal to 1.0, the H func- 


tions oscillate slightly, which generates errors in the failed state 


probabilities Q (t) . 

X/ 


Function FLAM, m module CARE3, calculates f(t) described above. 
It automatically set f (0) equal to zero, when actually the follow- 
ing three cases exist: 
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0 


, G> 


> 1.0 


I xi 

X , <»> = 1.0 

xi xi 

CO , w < 1.0. 

xi 

The correction to FUNCTION FLAM at time zero, when OMGA ( ICAT, ISTG) 
is greater than or equal to 1.0, is straightforward: 

FLAM =0.0 

IF (OMGA (ICAT, ISTG) .EQ. 1.0) FLAM = RLAM (ICAT, ISTG) 

Whereas the initialization and use of f(0) equal to infinity is 
impossible. Therefore the use of f (0) m the a(t), b(t) and c(t) 
computations had to be removed. J. J. Stiffler redefined these 
coefficients to be exact at one-sixth, midpoint and five-sixth of 
the range of interest of r - instead of at the two end points and 
the midpoint - m order to eliminate the use of f(0) (see ref. 8, 
pg. 36). This correction entailed an extensive change to sub- 
routine ABCST, in module CARE3 (see section 5.1). 

Also included m this Kolmogorov equation enhancement was the 

computation of '1 - R (t) ' - unreliability of a stage x module - 

x 

using the series expansion: A(t) 

A (t) 


2 3 

A (t) a (t) 

- + , where 

2 6 

<j) U) 

XI XI 

= X] A (t) and A (t) = X t 
1 xi xi xi 
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in the instances where '1 - R (t) < 1.0E-9' (see ref. 8, Table 1). 

x 

For example, if R (t) equals 0.999999999123456 (=1.0 single preci- 
x 

sion), '1 - R (t) * equals 0.0, while in fact '1 - R (t) ' equals 
x x 

0.876544E-9. Using the series expansion above gives a result accu- 
rate to eight or nine decimal digits without using double precision 

variables. This enhancement yielded better accuracy when computing 
* 

P^(t) - perfect coverage probability given failure vector H - which 
increased the accuracy of the failed state probabilities Q. (t) (cal- 

X 

culated using the Kolmogorov forward equation) . 


4.4 ENHANCEMENT RESULTS 


The enhanced Kolmogorov forward equation calculation of the 
failed state probabilities Q^(t) contains the following four posi- 
tive features, which will be detailed below: 

1) the "Q SUM" result (sum of failed state probabilities 
Q^(t)) is approximately one order of magnitude more 

accurate; 

2) it is possible to track results from extremely small 
times through an extranely large FT; 

3) it does not necessarily require an increase in execution 
time; 

4) the vast majority of the CARE III code remained unchanged. 

Tables 4-4, 4-5 and 4-6 contain comparison results of the en- 
hancement, which uses a logarithmic type time scale (the initial step 
size CVGSTP is used NPERST times before it is doubled; this increased 
step size is used NPERST times before it is doubled; and this con- 


33 



tinues NDUB times before FT is reached) , versus the equal step size 
option (FT divided by NSTEPS) . (See section 4.1 for the detailed 
explanation of the enhancement design.) Results from a total of six 
runs, using Example Problati 5, are contained in Tables 4-4, 4-5 and 
4-6. Three different FT values were used: 10 hours, 1600 hours and 
80,000 hours. For each FT, two runs were executed - one using the 
logarithmic step size method (labeled "lg") , and one using equal time 
steps (labeled "eq") . Table 4-4 is a comparison of the six runs at 
time 10 hours; Table 4-5 is a comparison at 1600 hours - of the four 
runs containing this time; and Table 4-6 lists results at 80,000 
hours using the two step size methods. Appendix B contains copies 
of the listings from these six runs of their final results. 


FT 

(hr.) 

Initial 
Step Size 
(lg or eq) 

"Q SUM" 

"P* SUM" 

"Q+P* SUM" 

10 

0. 2000e+0 

(eq) 

3. 56506e-5 

5. 86195e-7 

3. 62368e-5 

10 

9. 7704e-4 

(lg) 

3. 58802e-5 

5. 86195e-7 

3. 64664e-5 

1600 

3.2000e+l 

(eq) 

+ 

2. 22040e-5 

* 

5. 86195e-7 

2. 27902e-5 

1600 

1. 0173e-3 

(lg) 

3. 58803e-5 

5. 86195e-7 

3. 64665e-5 

80000 

1.6000e+3 

(eq) 

+ 

1.05057e-6 

* 

5. 86195e-7 

0. 16368e-5 

80000 

1. 1921e-3 

(lg) 

3. 58803e-5 

5. 86195e-7 

3. 64665e-5 

+ 

linear 

interpolation within 

first step 




* 


quadratic interpolation using three non-zero points 

Table 4-4 - Example Problem 5 Results at 10 hours 
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FT 

(hr.) 

Initial 
Step Size 
(lg or eq) 

"Q SUM" 

"P* SUM” 

"Q+P* SUM" 

1600 

3.2000e+l (eq) 

1.44899e-3 

1. 37866e-2 

1. 52356e-2 

1600 

1. 0173e-3 (lg) 

1.48729e-3 

1.37866e-2 

1. 52739e-2 

80000 

1.6000e+3 (eq) 

1. 68091e-4 

* 

1. 37866e-2 

1. 39547e-2 

80000 

1. 1921e-3 (lg) 

1.48344e-3 

1.37866e-2 

1. 52700e-2 

* 

quadratic interpolation using three non 

-zero points 


Table 4-5 - Example Problem 5 

Results at 1600 hours 


FT 

(hr.) 

Initial 
Step Size 
(lg or eq) 

"Q SUM" 

"P* SUM" 

"Q+P* SUM" 

80000 

1. 6000e+3 (eq) 

2.77075e-4 

9. 99658e-l 

9.99935e-l 

80000 

1. 1921e-3 (lg) 

1. 57438e-3 

9. 99658e-l 

1.00123e+0 


Table 4-6 - Example Problem 5 Results at 80000 hours 


The most valuable aspect of this enhancement is that the accur- 
acy of the run no longer depends on FT and the number of steps re- 
quested. Compare the results at 10 hours in Table 4-4. Each of the 
enhancement runs yield the same result at 10 hours - including the 
80,000 nour run, while the results steadily degrade using the equal 
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step size method. For very large FT, the "Q SUM" results - and thus 
the final unreliability - can be as much as one order of magnitude 
incorrect using the equal step size option. Hus can also be seen 
in the comparison at 1600 hours in Table 4-5. The fact that the CARE 
III model yields conservative failed state probabilities is exempli- 
fied in Table 4-6. The enhancement run declares that the unreliabil- 
ity at 80,000 hours is greater than 1.0. 


It is no longer necessary to make multiple runs using various 
FT's to try to achieve valid results at different times. Only one 
run is necessary using the maximum desired time as FT. It is possi- 
ble to see accurate results at extremely small times through extreme- 
ly large times with the one run. If FT is modified in the input 
file CREIN and program CAREIN is rerun, it is still of the upmost 
importance that program COVRGE be rerun before rerunning program 
CARE 3. The COVRGE functions are passed to CARE 3 at times based on 
the coverage functions' TZERO points and FT. 


This enhancement does not m itself cause an increase in execu- 
tion time because all functions are computed at the same number of 
times steps as the equal step size method. But m order to generate 
any failed state probabilities for runs with extremely large FT's, 
the truncation test for Q^(t) probabilities, based on the PSTRNC 
input parameter, had to be modified. This modification results in 
a larger number of "Q" vectors being computed, which does increase 
the execution time. The previous truncation test was based on the 
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* 


* 


value of P^(t) at FT * 1 P^ (FT) < PSTRNC' , the corresponding 
"Q" vector was not computed. For very large FT, the perfect cover- 
age probability, given a failure vector £ , may equal zero at FT 
even though the failed state probabilities for vector £ may be large 
enough to effect the final result. The enhanced truncation test is 


* 

currently based on the maximum P^(t) value given failure vector /. 
This results in the opposite problem that too many "Q" vectors are 
computed. It was necessary to increase the PSTRNC input parameter 
default value from 1.0E-14 to 1.0E-10 to minimize this problem. In 
the original released version of CARE III, it is possible that some 
important failed state probabilities are missing owing to the orig- 
inal PSTRNC truncation test. 


From these test cases, it appears as if this enhancement has 
added not only more accuracy to the failed state probabilities but 
has solved most of the problems with the large FT runs. 
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5.0 ELIMINATION OF OSCILLATION IN MODULE CARE 3 FUNCTIONS 

SUBROUTINE ABCST, in module CARE3, was recoded and throughly de- 
bugged during this enhancanent phase. It no longer calls FUNCTION 
FLAM for time zero. The need for this change was explained in sec- 
tion 4.3. The details of this change will be discussed m section 
5.1. Several test cases were run, and their ensuing problans, sol- 
utions and results will be detailed in section 5.2. 

5.1 CODE CHANGES RELATED TO FUNCTION OSCILLATION PROBLEMS 

The following mathematical expressions redefine the solution of 

the a(t), b(t) and c(t) coefficients used in the convolution of the 

reliability-model function with the coverage-model functions. (See 

the CARE III Phase II report (ref. 8), pg. 36 for a discussion of 

this convolution.) J. J. Stiffler redefined a(t), b(t) and c(t) to 

2 

make the approximation p (t-r) = a(t) + rb(t) + t c(t) exact at 

1 

known points that are as close as possible to the one-sixth, one- 
half and five-sixth points in the range of interest of t. This elim- 
inates the use of the weight function: 

u w - 1 

XI XI 

f(t) = X (t ) = (J) X t 
xi xi xi 

at time zero, which equals infinity when w , 0MGA(ICAT, ISTG) , is 

xi 

less than 1.0. This redefinition of a(t), b(t) and c(t) revolves 
around the Kolmogorov forward equation calculation enhancement dis- 
cussed in section 4.0 and its subsections. The independent variable 
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in the weight function, used to solve for a(t), b(t) and c(t), is no 

longer a multiple of At , with At the reliability step size 'FT/ 

r r 

NSTEPS ' . The time chosen as the independent variable in the weight 
function is now based on times generated by the doubling vector 
(CW3STP, NPERST, NDUB) as discussed in section 4.1. 


The mathsnatical expressions used to recode SUBROUTINE ABCST 


for the minimum value of t for which 

p (t) <= 0 or P (t) <= 0 for all t > t , 
X X max 

with 0 a user-defined threshold. 


for p (t) or P (t) that reach a non-zero 
X X 

steady-state value. 


where p (t) (X = DF and F) and P (t) (X = L, B, B, and DPT) are 
X X 

the coverage-model functions, and FT is the user-defined flight 
time or operating time. 


t = min(t, t ) 
r 0 

t = closest stored point to t - 5/6 t 

1 r 

t = closest stored point to t - 1/2 t 

2 r 

t = closest stored point to t - 1/6 t 

3 r 

where 0 < t < t < t . 

12 3 


follow. 

Given: 


t = 
0 


max 


FT 


39 



Choosing t , t and t m this manner eliminates the need for mter- 
12 3 

polation within the weight function f(t). (See ref. 8, pg. 42 for 
the complete definition of f ( t) - ) 


a(t), b(t) and c(t) are defined as follows: 


(t-t ) (t-t ) 

2 3 

a(t)= f(t ) 

(t -t ) (t -t ) 1 

2 1 3 1 


2t - t - t 
2 3 

b(t)= - f(t ) 

(t -t ) (t -t ) 1 

2 1 3 1 


1 

C (t)= f(t ) 

(t -t ) (t -t ) 1 

2 1 3 1 


(t-t ) (t-t ) 

1 3 

f( t ) + 

(t -t ) (t -t ) 2 

2 1 3 2 


2t - t - t 
1 3 

f(t ) + 

(t -t ) (t -t ) 2 

2 1 3 2 


1 

f (t ) + 

(t -t ) (t -t ) 2 

2 1 3 2 


(t-t ) (t-t ) 

1 2 

f(t ) 

(t -t ) (t -t ) 3 

3 1 3 2 


2t - t - t 
1 2 

f(t ) 

(t -t ) (t -t ) 3 

3 1 3 2 


1 

f(t ) 

(t -t ) (t -t ) 3 

3 1 3 2 


The above change to SUBROUTINE ABC ST, in module CARE 3, yields the 

same results, up to the sixth decimal digit, as the previous method 

for 1 OMGA ( ICAT , ISTG) >= 1.0'. And it eliminates the oscillation 

problem with the H (X = L, B, B, and DPT) and h (X = DF and F) 

X X 

functions when 'OMGA (ICAT, ISTG) < 1.0*. Several runs, discussed 
below, will illustrate this fact. 

5*2 TESTING AND RESULTS OF CODE CHANGES 

The following seven test cases, contained in Table 5-1, were run 
to test this change to SUBROUTINE ABCST. They are listed in the 
order in which they were run and are discussed below. 
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Test 


Case 

Name 

oj 

Source 

1 

transient 2c 

1.0 

reference 9. 

2 

transient 2c 

0.8 

modification to Test Case 1 

3 

Example Problem 5 

1.0 

reference 1. 

4 

Example Problem 8 

1.0 

reference 1. 

5 

* 

★ 

permanent le 

0.5 

reference 9. 

P = 3. 

6E3 (misprint in ref. 

9, pg. 

120 has p = 3.6E4) 

6 

permanent If 

2.0 

reference 9. 

7 

permanent li 

1.0 

reference 9. 


Table 5-1 - Elimination of Function Oscillation Test Cases 


Test cases 1 and 2, i.e. transient 2c with differing OMGA 
(ICAT, ISTG) values, were run before SUBROUTINE ABCST was modified. 
Test case 1 was run to see if the correction to FUNCTION FLAM, 
discussed in section 4.3, eliminated the oscillation problem in the 
"P* SUM" and thus the "Q+P* SUM" results. That is exactly what hap- 
pened. (See ref. 9, pp. 42, 43 and 121 for the earlier results.) 
Originally the oscillation m the "P* SUM" results was caused by the 
following function: 

-H (t | xi) 

DPT 

R (t) = e 
xi 

(Note that this is a correction to the misprint in ref. 8, pg. 37. 
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Also the definition of H (t|xi) on pg. 41 should have capital M's 

DPT 

to represent the moment functions.) The R (t) function was used in 

* xi 

the calculation of the (t) function. The H function contained 

I DPT’ 

oscillations previously due to the error m FUNCTION FLAM at time 

zero, discussed m section 4.3, which returned zero instead of A , 

xi 

RLAM (ICAT, ISTG) , for '0MGA(1CAT, ISTG) = 1.0'. These oscillations 
have been totally removed. The total system unreliability increased 
from 9.7825E-16 to 3.8337E-15 at 60 minutes, due to the corrections 
and enhancements. 

Test case 2 was run with 'QMGA =0.8' to be used as a compari- 
son before and after SUBROUTINE ABCST was modified to eliminate FUNC- 
TION FLAM at time zero. Before the correction, function H (tlxi) 

DPT 

oscillated due to the incorrect use of FLAM, at time zero equal to 
zero, in SUBROUTINE ABCST. Just as in the first test case, the total 
system unreliability increased - in this case from 6.3681E-13 to 
4.3350E-12 at 60 minutes. This increase was due solely to the correc- 
tion to SUBROUTINE ABCST. 

Test case 3, i.e. Example Problem 5, was run to check that the 
new SUBROUTINE ABCST performed as well as the prior version for a 
run without the oscillation problem, i.e. a run with 'OMGA = 1.0'. 

This test case was used earlier to debug the Kolmogorov forward 
equation calculation enhancement. The results prior to the ABCST 
change were presented in section 4.3. The "Q SIM" results are 
equivalent to the earlier run up to the sixth decimal digit. This 
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is a direct consequence of the same amount of difference existing in 

the H and h functions between the two runs. Therefore, it was 
X X 

concluded that the new version of ABCST performs at least as well - 
probably better due to the elimination of the interpolation within 
the weight function - as the previous version for runs with 'OMGA 
(ICAT/ISTG) >= 1.0*. It now performs correctly for runs with 'OMGA 
(ICAT, ISTG) < 1.0'. 

Test case 4, i.e. Example Problem 8, was run mainly to compare 
to the results contained in reference 1, using the enhancement code 
on a run with critical pairs. This test case consists of two subruns. 
The first subrun does not contain critical pair data in file "BXYFL" 
but the second subrun does. Yet when this test case was run, the 
following message was printed for both subruns: ** Warning - Critical 
Fault Pair File "BXYFL" does not contain data for this subrun. **. 
After a considerable amount of debugging was performed, the error 
was tracked to SUBROUTINE CRTLPR, in module CAREIN, and SUBROUTINE 
BUFBLK, contained in all three modules of CARE III. When the CDC 
version of CARE III was converted to run on the VAX machine, the 
block buffering commands BUFFER IN and BUFFER OUT were incorrectly 
converted using DO loops. This caused one machine word records to 
be written (read) to (from) disk instead of using large blocks of 
words per record. Hus error resulted in three problems: 

1) BACKSPACE 14 statement in SUBROUTINE NFLTDP, in module 
CARE3, repositioned file "BXYFL" incorrectly for runs 
with critical pair data m other than the first subrun; 

(Runs with critical pair data in the first subrun only 
executed properly because file "BXYFL" did not have to 
be repositioned.) 
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2) increased disk file sizes by 200 percent; 

3) increased I/O accesses by 225 percent in module CAREIN, 

16 percent in module COVRGE and 31 percent in module 
CARE 3. 

In SUBROUTINE CRTLPR, the critical pair data is supposed to be 
written to file "BXYFL" m blocks of 15,000 words per subrun (if 
critical pairs exist for that subrun) . Using one word records 
caused the BACKSPACE 14 statement to backspace one word instead of 
one 15,000 word block. When the second subrun tried to read the 
critical pair data, it hit end-of-file after one word and assumed 
that no critical pair data existed. Ibis error was temporarily 
corrected, m SUBROUTINE NFLTDP, by putting the BACKSPACE 14 state- 
ment in a 15,000 count DO loop. Tins enabled the run to execute 
correctly albeit very inefficiently. Statistics were taken on the 
file sizes, execution times and I/O accesses for this run. The 
incorrect conversion code was then corrected by replacing the DO 
loops with one implied DO statement. The following example was 
taken from SUBROUTINE BUFBLK: 

Incorrect Conversion of BUFFER IN: 

DO 110 IL = 1, ILST 

READ (IUNIT ,END=300,ERR=400) BLOCK(IL) 

110 CONTINUE 


Correct Conversion of BUFFER IN: 

READ (IUNIT,END=300,ERR=400) (BLQCK(IL) ,IL=1,ILST) 
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This type of correction was made to routines CRTLPR (in module 
CAREIN), BUFBLK (in all three modules) and BUFDAT (in module CARE3) . 
The 15,000 count BACKSPACE 14 DO loop was removed from SUBROUTINE 
NFLTDP; the run was executed again and the same statistics were 
taken as for the previous run. The conversion error resulted in 
the 200 percent increase in disk file sizes because the UNIX oper- 
ating system adds two words per record to the file for the end- 
of-record indicator and system use. The increased number of I/O 
accesses, caused by the incorrect conversion of the BUFFER IN and 
BUFFER OUT statements, yielded the following unnecessary increases 
in execution time: 


CAREIN: 

one word 

records - 

174.9 

seconds 

(1158% 

increase) 


blocked 

records - 

13.9 

seconds 



COVRGE: 

one word 

records - 

1117.6 

seconds 

( 16% 

increase) 


blocked 

records - 

962.9 

seconds 



CARE3: 

one word 

records - 

1056.8 

seconds 

( 57% 

increase) 


blocked 

records - 

672.6 

seconds. 




Both versions of CARE III (blocked and unblocked) yielded the 
exact same results. The total system unreliability equaled 5.8807E-7 
in reference 1 for Example Problem 8 and equaled 5.8968E-7 using the 
enhanced version of CARE III. 

Test cases 5, 6 and 7, i.e. permanent test cases le. If and li 
taken from reference 9, were run to further test the SUBROUTINE ABCST 
correction for 'QMGA < 1.0' and the enhancement code. Table 5-2 is 
a list of the results for the three test cases as reported m the 
CARE III Phase III report (ref. 9) versus the results using the en- 
hanced version of CARE III. 
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Test Version 3 Enhanced 


Case 

Name 

0) 

X 

"Q+P* SUM" 

"Q+P* SUM" 

5 

* 

le 

0.5 

1.0E-10 

2. 3101E-13 

4. 4851E-13 

6 

If 

2.0 

3.162E-3 

2. 4821E-13 

2. 4820E-13 

7 

li 

1.0 

1.0E-5 

1. 8629E-13 

1. 8725E-13 


P = 3.6E3 (misprint m ref. 9, pg. 120 has P = 3.6E4) 
Table 5-2 - Permanent Test Case Results at 60 mm. 


As was expected, test case 6 currently yields basically the same 
result as version 3. This is because FUNCTION FLAM and SUBROUTINE 
ABCST performed correctly for 'OMGA > 1.0' (= 2.0 m this case). 

Test case 7 results differ slightly due to the previously discussed 
error (see section 4.3) where FLAM returned zero at time zero, when 
'OMGA = 1.0', instead of RLAM (= 1.0E-5 in this case). The greatest 
difference occurred in test case 5, as was expected, due to the pri- 
or incorrect use of FUNCTION FLAM at time zero, in SUBROUTINE ABCST, 
when 'OMGA < 1.0'. The current results now behave as expected when 
comparing the three cases to each other. The failure rates in the 
three cases are shown in figure 5-1. 
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t 


Figure 5-1 - Graph of Failure Rates for 

Test Cases 5, 6 and 7 


The average failure rate is the same m all three cases - but the 
'OMGA = 2' and 'OMGA = 1/2' cases both result in more clustered 
failures ( 'OMGA = 1/2' is clustered at 't < 1/4'; 'OMGA = 2' is clus- 
tered at 't > 1/2') - since the dominate cause of failure is presum- 
ably due to the critical pairs, both 'OMGA = 2' and ’OMGA = 1/2' 
should be worse than 'OMGA =1'. Further since the 'OMGA = 1/2' 
failure rate for 't < 1/16' is greater than it ever gets for 'OMGA = 2' 
(since the maximum value of t in this case is 1 hour), 'OMGA = 1/2' 
should give the poorest results. 

To summarize - the oscillation problem m the various H and h 

X X 

functions has been eliminated, and SUBROUTINE ABCST has been correct- 
ed and recoded to fit into the Kolmogorov enhancement code. 
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6.0 CONSOLIDATION OF BOEING’S VERSION 4 AND ENHANCED CARE III CODE 

Boeing Computer Services' final version of CARE III (ref. 6) was 
converted to FORTRAN 77 and the enhancements detailed thus far in- 
serted into that version. Hie additional code needed to pass the 
TZERO times (maximum times for winch the coverage functions are non- 
negligible) to CARE3 was added to Boeing's exponential coverage mod- 
el. Tins oversite in the Boeing code is described below. 

6.1 CODE CONVERSION AND INSERTION 

The rewritten CAREIN module, received from NASA with the Boeing 
FTREE routines removed, was converted to FORTRAN 77 standard. This 
was a quick task - the only required change was the elimination of 
the NAMELIST's. All required changes to the CAREIN module, starting 
with the internally redundant modules enhancement, were made only to 
this new version of CAREIN. 

Concerning program COVRGE, Boeing's coverage routines and changes 
were successfully merged with the enhancement coverage code. Boeing's 
coverage routines converted to FORTRAN 77 readily due to their using 
six characters or less variable names. 

Each separate coverage function's TZERO point must be passed to 
CARE3. These times are passed to CARE3 m arrays TZROST(5,5), for 
coverage single-fault functions, and T0DF(5,5), for coverage double- 
fault functions. These arrays are contained m COMMON block /CVRGCM/. 
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While looking at the output of the COVRGE runs resulting from Boeing's 
changes to include an alternate exponential coverage model, it was 
evident that the TZERO times were missing on the printouts, i.e. they 
were zero for all non-zero functions. Boeing may have been under the 
misconception that these times are computed in CARE3 (see pg. 105 in 
ref. 5). This is incorrect. It is not possible to compute the TZERO 
point of the probability function from the corresponding moments that 
are passed to CARE3. Routines FHSFST, FHDFST, ABCST, FFSFST and 
FFDFST in CARE3 will not execute properly without these TZERO times. 
Note that a given function's TZERO value will equal FT if the func- 
tion reached a non-zero steady state value. 

The following code was added to Boeing's MSNGFN and MDBLFN sub- 
routines in module COVRGE and tested. Tins code sets maximum func- 
tion time values into arrays TZROST(ITYP,MCHI) and T0DF(ITYP,JTYP) , 
which are contained in common area /CVRGCM/. This common area was 
also added to both subroutines. Module CARE3 uses these values when 
convolving the moments of the coverage functions with the reliability 
function. 

Insertion into SUBROUTINE MSNGFN: 


*** STEADY STATE REACHED *** 


150 CONTINUE 
C 


KSNG = ITM 
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C 

C WRITE (6, 9020) ITYP, ITM, T1 

C 

C *** STORE MAXIMUM TIME FOR WHICH EACH COVERAGE FUNCTION *** 

C *** IS NONNEGLIGIBLE. MODULE CARE 3 USES THIS VALUE WHEN *** 

C *** CONVOLVING THE COVERAGE FUNCTIONS WITH THE RELIABILITY *** 

C *** FUNCTION. *** 

C 

DO 155 I = 1, 5 

*** IN THE MAJORITY OF CASES, FUNCTION IS NEGLIGIBLE *** 

*** AFTER 'Tl* *** 

TZROST ( ITYP, I) = Tl 

*** TEST FOR ZERO VALUED FUNCTION OR FUNCTION THAT *** 

*** REACHED A NON-ZERO STEADY STATE VALUE *** 

FKI = FSNG ( KSNG, I) 

IF (FKI .EQ. 0.0) THEN 

*** ZERO VALUED FUNCTION *** 

TZROST ( ITYP, I) = 0.0 

ELSE 

FKIM1 = FSNG ( KSNG— 1, I) 

FKIM2 = FSNG ( KSNG-2, I) 

IF (FKI. GT. 0.0 .AND. FKIMl.GT.0.0 .AND. FKIM2. GT. 0.0) THEN 
FMAX = AMAX1 (FKI , FKIMl, FKIM2) 

*** FUNCTION REACHED NON-ZERO STEADY STATE VALUE? *** 
*** IF SO, IT IS NONNEGLIGIBLE THROUGH ’FT' *** 

IF ( (ABS (FKI - FKIM2) / FMAX) .LE. l.E-4) 

TZROST ( ITYP, I) = FT 


ENDIF 
ENDIF 
155 CONTINUE 
GO TO 170 

*** NUMERICAL INTEGRATION ERROR *** 
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Insertion into SUBROUTINE MDBLFN 


*** STEADY STATE REACHED *** 


150 CONTINUE 
KDBL = ITM 

WRITE (6, 9020) ITYP, JTYP, ITM, Tl 

*** STORE MAXIMUM TIME FOR WHICH EACH COVERAGE FUNCTION *** 

*** IS NONNEGLIGIBLE. MODULE CARE 3 USES THIS VALUE WHEN *** 

*** CONVOLVING THE COVERAGE FUNCTIONS WITH THE RELIABILITY *** 

*** FUNCTION. *** 

*** IN THE MAJORITY OF CASES, FUNCTION IS NEGLIGIBLE *** 

*** AFTER 'Tl' *** 


TODF ( ITYP, JTYP) = Tl 

FKIJ = FDBL ( KDBL) 

IF (FKIJ .E<J. Q.0) THEN 

*** ZERO VALUED FUNCTION *** 

TODF ( ITYP, JTYP) =0.0 

ELSE 

FKIJM1 = FDBL ( KDBL-1 ) 

FKIJM2 = FDBL ( KDBL-2 ) 

IF (FKIJ. GT. 0.0 .AND. FKI JMl.GT. 0. 0 .AND. FK1JM2.GT.0.0) THEN 
FMAX = AMAXl (FKIJ, FKIJM1, FKIJM2) 

*** FUNCTION REACHED NON-ZERO STEADY STATE VALUE? *** 

*** IF SO, IT IS NONNEGLIGIBLE THROUGH ’FT’ *** 

IF ( (ABS (FKIJ - FKIJM2) / FMAX) .LE. l.E-4) 

TODF ( ITYP, JTYP) = FT 


ENDIF 
ENDIF 
GO TO 170 

*** NUMERICAL INTEGRATION ERROR *** 
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The enhancement discussed in section 4.0 and its subsections was 


successfully inserted into Boeing's exponential coverage model; two 
related bugs were found in Boeing's coverage model; and Boeing's final 
version of CARE3 was successfully converted to FORTRAN 77 and compiled 
cleanly. 

The "logarithmic time step" option (set user parameter LGTMST 
= .TRUE.) code was readily inserted into Boeing's exponential cover- 
age model. Routines MSNGMT and MDBLMT, which compute the moments 
of the single and double-fault output functions respectively, were 
changed to integrate at times determined by the doubling parameters 
CVGSTP, NPERST and NDUB instead of at multiples of RELSTP. The inte- 
gration subroutine (HSGEAR) performed as well at the unequal time 
intervals as it did using equal time steps. , 

CARE3 was converted to FORTRAN 77 and compiled cleanly. All 
seven character variable names were converted to six characters - 
as was done with the original version of CARE3 sent to Sequoia 
Systems, Inc. in August, 1983. Hie code had been completely restruc- 
tured by Boeing m the areas where the Kolmogorov equation enhance- 
ments had been made. Thus all Kolmogorov equation enhancements had 
to be restructured to fit into the new version. 

A debug subroutine PRNTFN was added to the CARE 3 module. This 

subroutine writes all formerly buffered H (X = L, B, B and DPT) and 

X 

h (X * DF and F) functions to a text file. This file was used to 
X 

check the Boeing conversion as well as the enhancement additions. 
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The following is a list of the major enhancement changes made 
to the converted FORTRAN 77 version of Boeing's CARE3 module. See 
the referenced sections for a detailed description of each enhance- 
ment. 

1) All functions are now computed using times stored in 
TMAR (ITSTPS) instead of at multiples of RELSTP (see 
sections 4.2 and 4.4). 

2) The 1 - R (t) enhancement calculation using the series 

X 

expansion was added in all appropriate routines (see 
section 4.3) . 

3) FUNCTION FLAM was corrected at time zero when OMGA 
equals 1.0 (see section 4.3). 

4) FUNCTION FINTGT, Simpson's rule integration routine 
based on equally spaced abscissas, was replaced by 
CUBINT, Simpson's rule integration based on nonequally 
spaced abscissas (see section 4.2). 

5) SUBROUTINE UNRELQ was changed to integrate the SUMK 
array using SUBROUTINE CUBINT (see section 4.2). 

6) FUNCTION FRXIFF was changed to integrate the h 

DPT 

function using SUBROUTINE CUBINT. (Boeing conversion 
change to integrate h function in CARE3 instead 

Dpr 

of in module COVRGE) . 

7) SUBROUTINE ABCST was replaced with the enhanced version 
that does not require the weight FUNCTION FLAM at time 
zero (see section 5.1). 

8) SUBROUTINE BUFDAT and SUBROUTINE BUFBLK were changed to 
buffer blocks of data as opposed to one word buffers 
(see section 5.2). 

9) SUBROUTINE PRNTFN was added to print functions resulting 
from the convolution of the single and double-fault 
coverage functions with the reliability-model function. 
These functions are contained in COMMON /BXYCQM/ and are 
written to file PRFNCS (unit 13), if CARE3 is compiled 
with CHIDBG set .TRUE. (New subroutine comparable to 
Boeing removed PRNTGH subroutine. See section 8.3 for a 
description of the functions stored m COMMON block 
BXYCOM) . 
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The plot programs CVGPLT and RELPLT were upgraded to interface 
correctly with the enhanced version of CARE III. The COMMON blocks 
were upgraded to match those in programs COVRGE and CARE 3, and the 
plot programs were converted to FORTRAN 77. The data structure of 
the plotting files is thoroughly detailed in sections 8.1 and 8.2. 

6.2 TESTING OF CONSOLIDATED CODE 

Example Problem 8, taken from reference 1, was used to test the 
enhancement code insertion into the exponential coverage model. The 
resulting moment functions were compared to output results using 
'MARKOV =2', i.e. the general coverage model, and 'LGrMST = .TRUE.'. 
They compared extremely well for moment functions produced from the 
integration of steadily decreasing functions. The moment functions 
that did not compare were those produced by integrating functions 
that increased to a steady state value. The reason for this poor 
comparison is discussed in section 6.3. 

Example Problem 8, taken from reference 1, was also used to test 
the CARE3 consolidation. The "Total System Unreliability" result at 
10 hours, using 'LGTMST = .TRUE.', equaled 5. 8820228332E-7. The "P" 
and "Q" vector results looked fine but functions in file PRFNCS for 
Subrun 2 only were totally incorrect. All functions in Subrun 1 were 
perfect but the functions m Subrun 2 appeared as if some important 
data was overwritten between subruns. This code error is discussed 
in section 6.4. 
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6.3 CODE ERRORS FOUND DURING COVRGE CONSOLIDATION 


Two related ougs were found in Boeing's code while debugging 
the enhancement. SUBROUTINE HSGEAR produces integrated moment func- 
tions which oscillate starting at the fourth or fifth decimal digit. 
Since the moment functions are the result of an integration, they 
should never decrease. Initially the oscillations were blamed on 
the enhancement code, but the oscillations were also found in output 
listings sent to Sequoia Systems, Inc. by NASA in December, 1983. 
Further investigation proved that the oscillations are inherent in 
Boeing's original code but become more obvious with the enhancement 
style of integration using smaller step sizes. Removing the C's from 
column one (conment line indicator) on the Boeing debug code WRITE 
statements, and running Example Problem 8, shows that the functions 
being integrated to become the moment functions are not always well 
behaved. One oscillates from positive to negative and back to posi- 
tive values. Many simply decrease steadily and abruptly become neg- 
ative. £Jut even well behaved functions produce integrated functions 
that oscillate slightly. 

The second nug occurs while integrating functions that reached a 
non-zero steady state value. The integration is not performed cor- 
rectly through FT thus producing a much smaller moment function. 

For example, function PBNG in fault type 4 of Example Problem 8 
reaches a steady state value of 0.9897 at time 0.1842E-2 hours. 

The function remains at this value through 'FT = 10 hours' , yet the 
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first moment function integration result at 10 hours is 0.1531E-2. 
The general coverage model integrates through FT and yields the cor- 
rect result at 10 hours of 9.897. 

Both problems are the result of Boeing's code integrating the 
functions farther m time than they were computed and using a zero 
value, i.e. using ' f ( > tmax) = O'. This is fine for functions that 
decreased to zero, but not for functions that reached a non-zero 
steady state value. The code was changed to return the last comput- 
ed value of the function, when results were requested at a point 
farther in time than computed. This increased the oscillation prob- 
lem, and the integrated function went negative when integrating a 
function that went negative - although it did correct the steady 
state valued function integration result. Both the equal and non- 
equal step size runs yielded the correct result of 9.897 at 10 hours 
for fault type 4, moment zero function MBNG. 

The code change was then corrected to use the final function 
value, during integration, only for functions that reached steady 
state. Also added was code to remove the oscillations from the 
moment functions after they are computed. The maximum integration 
result is repeated through FT, starting at the first decrease in 
the moment function. This time corresponds to the maximum time that 
the coverage function was computed. 
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6.4 CODE ERRORS FOUND DURING CARE 3 CONSOLIDATION 


Four bugs were found while debugging the Boeing and Sequoia 
consolidation of the CARE3 module. Two bugs were found in the new 
Boeing CARE3 code, one in the original CARE3 code, and one in the 
enhancement code in module COVRGE. These four bugs and their solu- 
tions will be described below. 


The four bugs were discovered using the debug SUBROUTINE PRNTFN , 

mentioned in section 6.1, which writes all H (X = L, B, B and DPT) 

X 

and h (X = DF AND F) functions to text file PRFNCS as they are com- 
X 

puted. Since these functions are the link between the coverage model 
and the reliability model, it is important that these functions are 
computed as accurately as possible. Each bug is described using a 
three step approach - describe the symptom of the bug, the problem 
caused oy the bug, and the correction made to the code to correct 
the bug. 


The first bug affects the single-fault calculations while the 
remaining three bugs affect the double-fault calculations. The four 
bugs can be summarized as follows: 

1) Garbage in H and h functions computed m subruns 2 and 

X X 

above. 

2) Double-fault arrays XXDFP and XXDFT, calculated using 
the h function and the reciprocal of the H function. 

Dr L 

too small becoming more accurate as the function progres- 
ses in time. 
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3) 


Oscillation in the 


arrays. 


( XXlDFP and (XX^DFT double-fault 

s! isf 


4) Double-fault arrays, listed above, equal to zero for sev- 
eral initial time steps then abruptly become large posi- 
tive values. 


Description of the first bug: 

SYMPTOM: 

Erratic values were generated for functions H (X = L, B, B and 

X 

DPT) and h (X = F) in subruns greater than one, in module CARE3. 

X 

For example, the integration of function h went from 0.27E-14 at 

DPT 

time 4.47E-6 (8th time step) to 0.0 at time 6.85E-6 (9th time step) 
to 0.17E-11 at time 9.23E-6 (10th time step). 

PROBLEM : 

The single-fault coverage moment functions, stored in arrays 
CMSTO (5,65,5) , CMSTl(5,65,5) and CMST2 (5,65,5) in COMMON /CVRGCM/, 
were overwritten by the "P* SUM" function calculation between sub- 
runs. 

CORRECTION: 

In the CARE3 main program, Boeing incorrectly substituted array 
PSTFAR for array SRPSTF m the subrun "P*" function calculation. 
Since PSTFAR is equivalenced to CMSTO (1,1,1) in COMMON /CVRGCM/, 
the single-fault coverage functions were overwritten with the "p*" 
calculation before the second subrun. The "P*" calculation code was 
returned to its original form using array SRPSTF. Array SRPSTF 
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(65,20) was defined and placed in COMMON /BXYCOM/ after array AXAR 
(20,65) and equivalenced to AXAR (1,1) , in order not to increase 
storage requirements. In the original code, SRPSTF was contained 
in COMMON /NONLDP/ and equivalenced to AXIAR (1,1,1) . Boeing re- 
moved COMMON /NONLDP/ and converted AXIAR(5,20,65) to AXAR(20,65) 

when they removed the buffering to disk of the H and h functions. 

X X 

Therefore the "P* SUM" calculation is now correct and functionally 
equivalent to the original design, and the coverage moment functions 
remain intact between subruns. 


Description of the second bug: 


SYMPTOM: 

The h functions, computed in SUBROUTINE CUT XX, contained much 
DF 

smaller values in the XXDFP and XXDFT arrays than was correct when 

compared to the results computed by hand. The XXDFP array contains 

values obtained by taking the reciprocal of the H function squared, 

L 

multiplied by the h function at a given time. Therefore it was 

DF 

possible to check the program's results using the debug print file 
PRFNCS. 

PROBLEM : 

The XXDFP and XXDFT arrays were computed using a constant value 

for the H function. Boeing used an uninitialized variable XHLTP 
L 

to represent the H function within the double-fault time step loop. 

L 

Since this same variable had been used previously m the single-fault 

functions' calculations, it contained the H function value at FT. 

L 

Therefore the H function was treated as a constant function during 
L 

the calculation of the double-fault functions. 
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CORRECTION: 


In SUBROUTINE GNTXX, the following line of code was inserted 

after the DO 230 IT = 1, ITSTPS line: XHLTP = HLTP ( ISTG, IT). 

This initializes XHLTP to the H function value that corresponds to 

L 


the current time step. 


Description of the third bug: 


SYMPTOM: 

The double-fault functions' calculations, stored m arrays 

! XX iDFP (530,1) (double-fault permanent) and fXXlDFT (530,1) 

x| ix) 

(double-fault transient) in COMMON /BXYCOM/, contained slight oscil- 
lations. The functions would slightly increase then decrease repeat- 
edly as the function approached FT. 

PROBLEM: 


The weight function f(t), used in the convolutional approximation 

when computing the h functions, was programmed originally using an 

DF 

incorrect definition. The incorrect code uses r (t) when x is a 

x l 

transient fault. The following is the correct definition: 


'r (t) r (t) 
x y 

r (t) 

x 


f(t) = H (tlx ) 
B l 


X (t) < 
y r (t) 

3 y 


1 


x and y are non- 
i 3 

transient faults 
x non-transient and 
i 

y transient faults 
3 

x transient and 

l 

y non-transient faults 
3 

x and y are transient 
i 3 

faults 
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CORRECTION: 


In FUNCTION FFDFST , in module CARE3, the sense of the transient 

fault test was incorrect. The test was corrected to read: 

IF ( .NOT.TRNSFC (ICAT, ISTG) ) HBNGVR = HBNGVR * RXAR (ISTG,KINDX) . 

This has the effect of taking the H function and multiplying it by 

B 

r (t) , if x is a non-transient fault. The previous result is then 
x 1 

multiplied by \ (t) and by r (t) , if y is a non-transient fault. 

y y 1 

D 

This correction removed the slight oscillations contained in the 
double-fault arrays as the functions approached FT. 

Description of the fourth bug: 

SYMPTOM: 

The double-fault function arrays, listed in the previous bug 
description, contained zeros for several initial time steps then 
abruptly took on relatively large values. 

PROBLEM: 

The double-fault moment functions, passed from the COVRGE module, 
were incorrect for the first several time steps. The functions were 
linear at the beginning due to COVRGE using linear interpolation 
for too many points within the first time step of the double-fault 
coverage functions. This was done because of the enhancement code 
scheme to use the minimum TZERO value of all coverage functions to 
compute the CVGSTP - coverage step size for passing the moment func- 
tions to module CARE3. 
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CORRECTION: 


Module COVRGE was modified to use the maximum 'i’ZERO value, less 
than FT, of all coverage functions to compute the CVGSTP. This 
totally eliminates interpolation within the first step of any cov- 
erage function, where the function tends to change most rapidly. 

The effect that this correction has on the enhancement code is to 
generate a much larger CVGSTP, relative to die original method (see 
section 4.1), but it is still many orders of magnitude smaller than 
the * RELSTP = FT / NSTEPS’ method used when ’ LGTMST = .FALSE.’. 
Therefore the enhanced method, used when ’LGTMST = .TRUE.’, is still 
as valid as originally designed, and the resulting moment functions 
that are passed to CARE 3 are more accurate. 
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7.0 IMPLEMENTATION OF INTERNALLY REDUNDANT MODELING CAPABILITY 


There are two possible methods for representing internally re- 
dundant modules m the CARE III model. The straightforward approach 
is simply to break each internally redundant module into one or more 
separate stages and to treat each of its constituent submodules as 
modules in one of those stages. Consider, for example, a memory mod- 
ule consisting of 40 bit lines supported by four redundant bit lines 
and some common logic needed to control manory access and to effect 
reconfiguration should one of the bit lines fail. This module could 
be treated as two stages, one stage representing the common logic 
and the second the 44 bit lines configured m an "m-of-n" configura- 
tion (with m = 40 and n = 44). 

The disadvantage of this approach is that both the number of 
stages and the number of modules that have to be accommodated by the 
model may have to be considerably greater than they would have been 
were the modules not internally redundant. If, m the previous 
example, the system contains one stage with ten such internally re- 
dundant modules, using the approach just described would increase 
the number of stages to 20 (10 representing the 10 sets of common 
logic and 10 representing the 10 sets of 44 bit lines) and the num- 
ber of modules would increase from 10 to 450 (10 + 44*10). This of 
course, could vastly increase the computational time and could even 
exceed the program's capacity. 
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An alternative method is to recognize that each such internally 
redundant module appears to the system as a module subject to trans- 
ient failures. That is, each failure of a redundant submodule is a 
transient event m that it incapacitates the module only temporarily 
so long as a redundant submodule is available and recovery is suc- 
cessful. Ihus, the module can be modeled by defining a transient 
failure rate in terms of the rate at winch submodule failures occur 
until no redundant submodules remain, and a permanent failure rate 
in terms of the rate at winch failures occur either in the non-redun- 
dant portion of the module or in the redundant portion when no redun- 
dant submodules remain. The coverage model then determines the pro- 
bability that the system recovers from each of these two types of 
failures. (Note that the coverage parameters need not be the same 
for the two failure types.) 

7.1 MATHEMATICAL MODEL 

Specifically, let ( ^ , w ) be the Weibull parameters character- 

1 1 

izing the failure rate of each of the redundant submodules and let 

( A # a) ) t>e the failure rate parameters for the non-redundant portion 
2 2 

of the module. Further, let n be the number of available submodules 
and m the minimum number needed for the module to function and con- 
sider the following two cases: 
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Case 1 - REDUNDANT SUBMODULES INACTIVE - 


Only active submodule failures cause reconfiguration. The inter- 
nally redundant module always uses exactly m submodules to perform 
its intended function. Each of the remaining functioning submodules 
is used only as needed to replace one of these submodules (or an ear- 
lier replacement for one of these submodules) . Thus, reconfiguration 
is undertaken only when one of tne m currently used submodules fails. 
The internally redundant module fails when there is no longer a re- 
dundant submodule to replace an active, failed submodule. The model 
assumes that when one of the redundant submodules replaces a failed 
submodule, it will have the same failure rate as the other function- 
ing submodules. This is true, for example, if the redundant submod- 
ules are always powered or in any other situation m which the dor- 
mancy factor is unity. 

Example: Random access memory devices in combination with an 

error detecting code. When an error is detected, recovery in- 
volves testing the memory to isolate the defective device and 
switching m a replacement. Until that time, the replacement 
devices are off-line; a failure m one of these devices may be 
detected by a background test but does not cause a reconfigura- 
tion. 
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Case 2 - REDUNDANT SUBMODULES ACTIVE - 


Any submodule failure forces a reconfiguration. The internally 
redundant module uses all available submodules. Each failure results 
in a reconfiguration with the reconfigured internally redundant mod- 
ule continuing to function with successively fewer submodules until 
the number of functioning submodules drops below m. 


Example: N-raodular redundancy with an adaptive voter. Each non- 
unanimous vote causes a reconfiguration m winch all submodules 
not agreeing with the majority are switched out. 


Using input parameter ACSP(x) , defined in section 7.2, the user 
chooses which case to model: Case 1 (REDUNDANT SUBMODULES INACTIVE) 
or Case 2 (REDUNDANT SUBMODULES ACTIVE). Note that Case 1 is more 
reliable than Case 2. The reason for this is that in Case 1, only m 
submodules can fail and, by failing, cause a reconfiguration, thereby 
making the system vulnerable to a recovery failure. In Case 2, a 
failure of any of the n submodules can result m a system failure. 


The submodule transient failure rate A (t) and the module per- 

1 

manent failure rate A (t) can be defined as follows. (Note that 

2 

A (t) is a function of time and uses the Weibull parameters (A , co ) 

1 11 
in its definition; likewise A (t) is a function of time and uses the 

2 

Weibull parameters (A , w). See pp. 29-30 in ref. 2 for a descnp- 

2 2 

tion of the Weibull parameters.) 
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with 

0) CO U) 

1 12 



-A (t) 

2 

Function e is used in the computation of the function 

R (t) : reliability of a stage x module. It specifies the probabil- 
x 

lty that a given stage x module, with internally redundant submod- 
ules, has not experienced a permanent type fault by time t. (See 
ref. 8, pg. 37 for the equivalent definition for modules with no 
internal redundancy.) 

7.1.1 DERIVATION OF MATHEMATICAL MODEL 


Derivation: 

A (t) = submodule failure rate at time t given that the internally 

1 

redundant module will still be operational if it success- 
fully recovers from the failure (i.e. that at least m oper- 
ational submodules remain after the failure) . 

n-m-1 

^ A (t|/> P^(t|S) 

/= 0 

with A (t|£) - the submodule failure rate given that the inter - 

1 

nally redundant module has suffered / previous submodule 
failures 


Thus A (t) = 

1 
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and 


P (t|S) - the probability that the internally redundant 
Hr 

module has suffered / failures by time t given that it is 
still operational at time t. 


Because only active submodule failures are relevant in Case 1 while 
all submodule failures are relevant in Case 2: 
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the last expression following from the equality 



7.1.2 LIMITATION OF MATHEMATICAL MODEL 

This second approach to modeling internally redundant modules 
should not result in any significant increase m computational time 
due to this internal redundancy. Hie approach does suffer from one 
limitation, however: it is not possible to treat the case in which 
submodules are critically coupled (e.g., the case in which one sub- 
module fails during recovery from an earlier submodule failure and 
thereby causes a system failure) . If the submodules are critically 
coupled m this way, the first of the two approaches should be used 
instead (see section 7.0). 

7.2 ADDED INPUT PARAMETERS 

The following input parameters, listed with their corresponding 
NAMELIST and definition, were added to module CAREIN to accommodate 
the internally redundant modeling capability: 

NAMELIST PARAMETER DEFINITION 

$STAGES NSUB(x) Number of identical submodules within each 

internally redundant module in stage number 
x. Hie default value for NSUB(x) is 0. 

$STAGES MSUB(x) Minimum number of identical submodules needed 

within each internally redundant module in 
stage number x. Hie default value for MSUB 
(x) is 0. 
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NAMELIST PARAMETER DEFINITION 


$STAGES ACSP(x) Flag set .TRUE, states that all non-failed 

submodules are used within each internally 
redundant module m stage number x (redundant 
submodules active). If set .FALSE., only 
MSUB(x) submodules are active at any instant 
(redundant submodules inactive) . Hie default 
value for ACSP(x) is .TRUE. 

$FLTCAT JSBTYP ( 1 ,x) Defines the fault type(s) assigned to stage 

x, with internally redundant modules, that 
affect the redundant submodules. Note that 
for stage x, with internally redundant mod- 
ules, the original fault type parameter JTYP 
(i,x) defines the fault type(s) assigned to 
stage x that affect either the non-redundant 
portion of the module or the redundant por- 
tion when no redundant submodules remain. 

The default value for JSBTYP(i,x) is 1. 

SFLTCAT OMGSUB(i,x) Parameter w of the Weibull fault occurrence 

(jj-1 

rate Ato(At) characterizing the failure 
rate of each of the redundant submodules for 
fault type 1 for stage x with internally 
redundant modules. Note that for stage x, 
with internally redundant modules, the ori- 
ginal a) parameter QMG(i,x) defines the Wei- 
bull parameter w characterizing the failure 
rate of either the non-redundant portion of 
the module or the redundant portion when no 
redundant submodules remain. The default 
value for QMGSUB(i,x) is 1.0. 

$FLTCAT RLMSUB(i,x) Weibull parameter A characterizing the fail- 
ure rate of each of the redundant submodules 
for fault type l for stage x with internally 
redundant modules. Note that for stage x, 
with internally redundant modules, the ori- 
ginal A parameter RU“l(i,x) defines the Wei- 
bull parameter A characterizing the failure 
rate of either the non-redundant portion of 
the module or the redundant portion when no 
redundant submodules remain. The default 
value for RLMSUB(i,x) is 1.0E-4. 
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Some differing terminology exists between this document and the 
"CARE III Model Overview and User's Guide (first revision)", refer- 


ence 2, pertaining to modeling faults using CARE III. This document 
contains the original terms used when CARE III was first coded because 
of the numerous references to the program variables and their corres- 
ponding terms. The following list details the differing terminology. 



Original 

Reference 2 

Defined By 

Using 


Terminology 

Terminology 

Input Parameters 

NAMELIST 

1) 

fault type 

fault model 

ALP(i), BET ( l ) , DEL ( l ) , etc. 

5FLTTYP 

2) 

fault category 

fault type 

RLM(l,x), RU4SUB(i,x), etc. 

$FLTCAT 


For each stage with internally redundant modules, up to five 
different pairs of fault occurrences (or categories) may be defined. 
Each such fault pair consists of a permanent fault category assoc- 
iated with either the non-red undant portion of the module or the re- 
dundant portion when no redundant submodules remain - defined using 
parameters JTYP(i,x), OMG(i,x) and RLM(i,x) - and a second permanent 
fault category associated with each of the redundant submodules - 
defined using parameters JSBTYP(i,x), QMGSUB ( 1 ,x) and RlffSUB ( 1 , x ) . 

Thus for a stage x with internally redundant modules, up to ten dif- 
ferent types of fault occurrences may be defined but they must be 
defined in pairs - one permanent fault category, used in the module 

permanent failure rate function ^ (t) , and a second permanent fault 

2 

category, used in the submodule transient failure rate function ^ (t) . 

1 
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Note that original parameter NFCATS (x) defines the number of pairs 
of fault categories assigned to stage x with internally redundant 
modules. Thus NFCATS (x) must always be defined less than or equal 
to five. 

The coverage fault types assigned to JTYP(i,x) and JSBTYP(i,x), 
for stage x with internally redundant modules, must have ALP(i) and 
BET ( 1 ) parameters set equal to zero (the default value), which de- 
fines the fault-handling model type as a permanent one. The submod- 
ule transient failure rate function A (t) accounts for the transient 

1 

faults resulting from submodule failures, in accordance with the 
user-defined permanent, submodule fault category. This fault cate- 
gory can be termed the "effective transient" fault category. 

7.3 CODE ADDITIONS AND MODIFICATIONS 

The CARE IN module was modified to accept the new input param- 
eters. The CARE 3 module was modified to accept and use the new 
input parameters to calculate the failure probability of a system 
defined with stage (s) consisting of internally redundant modules. 

It was not necessary to modify the fault tree handling portion of 
module CAREIN; therefore the CAREIN changes were straightforward 
and minimal. Tests were added to SUBROUTINE VLDNML to check the 
correctness of the new input parameters. Module COVRGE was not ef- 
fected by this enhancement and thus was not modified. Module CARE3 
required quite a few additions and modifications to handle this en- 
hancement. 
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The modifications made to module CARC3 revolve around the com- 


putation of the reliability functions H (X = L, B, and B) and 

X 

h (X = DPT, F and DF) . Additions were made to routines GNTXX( ISTG) 


X 

and GNTXY ( ISTG) to compute all functions over the fault category 


pairs described above, for ISTG with internally redundant modules. 


The logical array TRNSFC(i,x) used to test for a transient or non- 


transient fault category 1 for stage number x was converted to an 


integer array NTRNFC(i,x) with the following definition: 


NTRNFC ( l , x ) 


0 specifies a non-transient fault category, 

1 specifies a transient fault category, 

2 noth a permanent and an "effective tran- 
sient" fault category l exist for stage 
x with internally redundant modules. 


It was necessary to add a 6500 word array to COMMON /BXYCOM/ - 

HBNGSB ( 20, 5, 65). It was not possible to equivalence HBNGSB to 

another array. Array HB1.CSB indexed by ( x, l, t) is paired with 

original array HBNG ( 20, 5, 65) also indexed by ( x, i, t) . For 

stage number x with internally redundant modules HBNG contains the 

H function for the permanent fault category l given stage number x, 
B 

while the HBNGSB array contains the H function for the "effective 

B 

transient" fault category l given stage numoer x. This was the only 

additional array required for this enhancement because the H func- 

B 

tion is the only function stored per fault category. All other H 

X 

and h functions are stored as sums over the transient and non-tran- 
X 

sient fault categories. Thus the fault category pairs defined for 
stage number x with internally redundant modules were summed into 
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the appropriate variables. Variables ending in P received the per- 
manent fault category contribution, and variables ending in T re- 
ceived the "effective transient" fault category contribution. 

Slight modifications were made to FUNCTIONS FFSFST and FFDFST 
to check which fault category was currently being processed of the 
pair of fault categories, for ISTG with internally redundant mod- 
ules. Given fault category (ICAT,ISTG) for single-fault functions, 
logical variable TRNISB set .TRUE, flags the "effective transient" 
fault category (set .FALSE, flags the permanent fault category) of 
the fault category pair as the one currently being processed. For 
double-fault functions, TRNISB is used for the fault category (ICAT, 
ISTG) and TRNJSB is used for (JCAT,JSTG). Logical variables TRNISB 
and TRNJSB were added to COMMON /CONFIG/ after array NTRNFC ( i , x ) de- 
fined above. 


Additions were made to FUNCTION FLAM to compute the module 

transient failure rate A (t) and the module permanent failure rate 

1 

A (t) , mathematically defined in section 7.1, for ISTG with mter- 
2 

nally redundant modules. FUNCTION FPSTSB was added to module CARE3 

* 

to compute the P^ (t) function, also defined m section 7.1, which is 
used in FUNCTION FLAM to compute the module failure rates. 


7.4 TESTING OF THE ENHANCEMENT 


The original FTMP test case, used to test Phases I, II and III 
of the original CARE III program (refs. 8 and 9), was used to debug 
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this enhancement. The memory modules' stage was additionally defined 
with NSUB equal to 44 and MSUB equal to 40 with redundant submodules 
inactive. 


Several different PIMP test cases were generated to test the 
internally redundant modeling capability. The main two test cases 
that helped debug this enhancement are contained m figures 7-2 and 
7-3. The first consists of the original test case with no internal 
redundancy, and the second contains internal redundancy m the memory 
modules but has the submodule failure rate set to zero. These two 
test cases execute different code paths and routines, yet must yield 
exactly the same final results. After several iterations of testing 
and Dug corrections, that is exactly what happened. 

The two test cases described above are listed along with the 
original FIMP test case (fig. 7-1) for comparison. The FTMP criti- 
cal pairs fault tree is not shown m all cases because it is lengthy 
and was not modified at all for these test runs. Hie input is shown 
in both list directed format and m NAMELIST format. Notice that a 
third permanent fault type was added. This was necessary because of 
the internal redundancy test case. Stages with internally redundant 
modules must have fault categories defined using only permanent fault 
types. In order to get the exact same final results, the run without 
internal redundancy had to have the memory modules' stage's fault 
categories defined using the same fault type as the run with the in- 
ternally redundant memory modules. 
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F1MP Original Test Case: 

List-directed Syntax: NAMELIST Syntax: 


2 , 10 . 0 , 10 . 0 , 

1 . 0 , 1 . 0 , 

100.0, 360.0, 

0 . 0 , 0 . 0 , 

0 . 0 , 0 . 0 , 

1 , 1 , 

1 , 1 , 

1 . 0 , 1 . 0 , 

1 . 0 , 1 . 0 , 

1 . 0 , 1 . 0 , 

0. 05, 1.0E-5, 

.TRUE., , , 

1, .TRUE./ 

3, 15 

11 


3 

2 , 2 , 1 , 

9 9 

1 , 1 , 

2 , 


1.0E-4, 0.18E-4, 

1.0E-4, 0.18E-4, 

1.0E-6/ 

100.0, 50, 2, 

.TRUE., .TRUE., , 
1.0E-10/ 



$FLTTYP 


OSTAGES 


$FLTCAT 


$RNT IME 


NFTYPS=2, 

ALP = 2 * 10., 

BET’ =2*1., 

DEL = 100., 360., 

RHO =2*0., 

EPS =2*0., 

IDELF= 2*1, 

IRHOF= 2*1, 

IEPSF= 2*1, 

PA =2*1., 

PB =2*1., 

C =2*1., 

DBLDF = 0.05, 

TRUNC = 1.0E-5, 

CVPRNT = .TRUE., 

MARKOV = 1, 

LGTMST = . TRUE . $ 

NSTGES = 3, N = 15, 9, 5, 
M = 11, 5, 3, 
NOP (1,3) = 3, IRLPCD = 4$ 
NFCATS = 2, 2, 1, 

JTYP (1,2) =2*1, 

JTYP (1,3) = 2, 

RLM(1,1) = 1.0E-4, 

RLM (2, 1) = 0.18E-4, 

RI24 (1, 2) = 1.0E-4, 

RLM (2, 2) = 0.18E-4, 
RLM(1,3) = 1. 0E-6$ 

FT = 100.0, NSTEPS = 50, 
ITBASE = 2, 

SYSFLG = .TRUE., 

CPLFLG = .TRUE., 

PSTRNC = 1. 0E-10$ 
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(FTMP Original Test Case continued) 


PIMP ARCHITECTURE - 15 PROCESSORS, 9 MEMORY MODULES, 5 BUSES 
WITH CRITICAL FAULT PAIRS (ORIGINAL TEST CASE) - NOVEMBER, 1984. 
13 4 4 
4 0 12 3 

FTMP CRITICAL-FAULT PAIRS FAULT-TREE. 

1 29 30 55 

1 1 15 

2 16 24 

3 25 29 


30 

2 

1 2 

! 3 







31 

2 

4 5 

■ 6 







32 

2 

7 8 

I 9 







33 

2 

10 

11 

12 






34 

2 

13 

14 

15 






35 

O 

30 

31 

32 

33 

34 




36 

2 

16 

17 

18 






37 

2 

19 

20 

21 






38 

2 

22 

23 

24 






39 

O 

36 

37 

38 






40 

2 

25 

26 

27 

28 

29 




41 

O 

2 3 

1 5 

6 8 

9 

11 

12 

14 

15 

42 

A 

25 

41 







43 

O 

1 3 

1 4 

6 7 

9 

10 

12 

13 

15 

44 

A 

26 

43 







45 

O 

1 2 

! 4 

5 7 

8 

10 

11 

13 

14 

46 

A 

27 

45 







47 

O 

42 

44 

46 






48 

O 

17 

18 

20 

21 

23 

24 



49 

A 

25 

48 







50 

O 

16 

18 

19 

21 

22 

24 



51 

A 

26 

50 







52 

0 

16 

17 

19 

20 

22 

23 



53 

A 

27 

52 







54 

O 

49 

51 

53 






55 

O 

35 

39 

40 

47 

54 





Figure 7-1 


FTMP Original Test Case (pre- internally 
redundant modeling capability format) 
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9 9 

9 9 

9 

9 9 

t t / 

100.0, 50, 2, .TRUE., .TRUE., , 

1.0E-10/ 

Fi'MP ARCHITECTURE - 15 PROCESSORS , 9 MEMORY MODULES, 5 BUSES 
WITH CRITICAL FAULT PAIRS (NO INTERNAL REDUNDANCY) - NOVEMBER, 1984. 
13 4 4 
4 0 12 3 

• 

. (Critical Pair Fault-Tree not listed) 


Figure 7-2 - FTMP Modified Test Case (without 

internally redundant modules) 
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List-directed Syntax: 


NAMELIST Syntax: 

3, 10.0, 

10.0, 

0.0, 

$FLTTYP 

NFTYPS=3 , 

1.0, 

1.0, 

0.0, 


ALP = 2 * 10., 0.0, 

100.0, 

360.0, 

100.0, 


BET = 2 * 1., 0.0, 

0.0, 

0.0, 

0.0, 


DEL = 100., 360., 100., 

0.0, 

0.0, 

0.0, 


RHO =3*0., 

1» 

1, 

1, 


EPS =3*0., 

1» 

1, 

1, 


IDELF= 3*1, 

1, 

1, 

1, 


IRHOF= 3*1, 

1.0, 

1.0, 

1.0, 


IEPSF= 3*1, 

1.0, 

1.0, 

0.0, 


PA =3*1., 

1.0, 

1.0, 

1.0, 


PB =2*1., 0., 

0.05, 

1.0E-5, 



C =3*1., 

.TRUE., 

9 9 



OBLDF = 0.05, 

1, 

.TRUE./ 



TRUNC = 1.0E-5, 

3, 15, 

9, 

5, 


CVPRNT = .TRUE., 

11, 

5, 

3, 


MARKOV = 1, 

0, 

44, 

0, 


LGTMST = .TRUE. $ 

0, 

40, 

0, 

^STAGES 

NSTGES = 3, 

.TRUE., 

FALSE., 

.TRUE., 


N = 15, 9, 5, 

9 

0 0 9 9 



M = 11, 5, 3, 

9 

9 9 9 9 



NSUB = 0, 44, 0, 

3, 

9 9 9 9 



MSUB = 0, 40, 0, 

9 

. . 4/ 



ACSP = .T., .F., .T., 

2, 2, 1, 

9 9 



SFLTCAT 

NOP (1,3) = 3, IRLPCD = 4$ 
NFCATS = 2, 2, 1, 

3, 3, 




JTYP (1,2) =2*3, 

2, 

9 9 




JTYP (1,3) = 2, 

JSBTYP (1,2) =2*3, 

3, 3, 

9 

9 9 

9 9 

9 




RIM (1, 1) = 1.0E-4, 
RLM(2,1) = 0.18E-4, 
RLM(1,2) = 1.0E-4, 
RIM(2,2) = 0.18E-4, 
RIM (1, 3) = 1.0E-6S 

1.0E-4, 0. 

18E-4, 



RIMSUB (1, 2) = 0.0, 

1.0E-4, 0. 

18E-4, 



RLMSUB(2, 2) = 0.0$ 

1.0E-6, 



$RNTIME 

FT = 100.0, NSTEPS = 50, 

9 9 




ITBASE = 2, 

9 9 

9 




SYSFLG = .TRUE., 
CPLFLG = .TRUE., 

, , 0. 

0, 0.0, / 



PSTRNC = 1.0E-10$ 

100.0, 50 

, 2, .TRUE 

. , .TRUE. , 

9 



1.0E-10/ 

FTMP ARCHITECTURE - 15 PROCESSORS, 9 MEMORY MODULES, 5 BUSES 
WITH CRITICAL FAULT PAIRS AND INTERNALLY REDUNDANT MEMORY MODULES. 
NOVEMBER, 1984 - With RIM = ORIGINAL LAMBDA and RIMSUB = 0.0. 

THIS SHOULD YIELD THE EXACT SAME RESULTS AS THE TEST CASE NOT USING 
INTERNALLY REDUNDANT MODULES. 

13 4 4 
4 0 12 3 
• 

. (Critical Pair Fault-Tree not listed) 


Figure 7-3 - FTMP Modified Test Case (with internally 

redundant memory modules) 
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The final result for both test cases at 100.0 minutes equaled 
1.1187474946E-08 exactly. (See Appendix C for the summary results 
of the run using the test case shown in figure 7-3. This listing 
also shows the modified output style due to the internally redundant 
modeling enhancement.) 

While running these test cases, a bug was found in Boeing's cov- 
erage model m program COVRGE. Vflien COVRGE was run with input param- 
eter MARKOV set to 1, the resulting double-fault moment functions 
were exactly zero. When the general fault-handling model was run, 
the resulting double- fault moment functions contained valid non-zero 
values. Hie error was tracked down to subroutine MDBLFN in module 
COVRGE. Two integer variables LAM1 and LAM2 were being used as real 
variables, i.e. they should have been declared real in a TYPE state- 
ment. A computed real value based on the input parameters BET, DEL 
and RHO was stored in LAM1 and LAM2. In the FTMP test case, this 
computed value equaled 0.0166 minutes and when placed in the integer 
variables, was truncated to zero - thus the zero valued double-fault 
function results. These two variables were renamed RLAMl and RLAM2, 
in subroutine MDBLFN, and the program ran correctly. 

Four additional variations on the FTMP modified Test Case (with 
internally redundant memory modules) - see figure 7-3 - were run to 
test the internally redundant modeling capability. The internally 
redundant portion of the computer configuration, modeled in this test 
case, has nine memory modules in stage two. Each memory module con- 
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sists of 40 bit lines supported by four redundant bit lines, and some 
common logic needed to control memory access and to effect reconfig- 
uration should one of the bit lines fail. A minimum of five memory 
modules are required for this stage to be operational. The input 
parameters used to describe this configuration for stage two are 
N (2) = 9, M{2) = 5, USUB (2) = 44, MSUB(2) = 40, and ACSP(2) = .FALSE. 

The Keibull input parameters (RLMSUB(i,2) , QMGSUB(i,2)) charac- 
terizing the transient failure rate of each of the active bit lines, 
and (RLM(i,2), CMG(i,2)) characterizing the permanent failure rate 
of the common logic were varied, in the first three test cases listed 
in Table 7-1, such that ' (MSUB * RLM5UB(i,2)) + RLM(i,2)’ equals 
the original failure rate used m the FTMP test case without inter- 
nally redundant memory modules. Two fault categories were defined 
for the memory module stage, as in the original test case: the ori- 
ginal failure rate for the first fault category equaled 1.0E-4 and 
for the second fault category equaled 0.18E-4. Therefore originally 
'RLM(1,2) = l.QE-4 ' and *RLM(2,2) = 0.18E-4' with ’QMG(1,2) = OMG 
(2,2) = 1.0', which says that each memory module is susceptible to a 
permanent fault with either constant rate 1.0E-4 per hour or 0.18E-4 
per hour. 

The fourth test case, listed m Table 7-1, was discussed above. 

The failure rates were defined so that the unreliability of the sys- 
tem would equal exactly the FTOP test case run without internal redun- 
dancy m the memory modules. By setting the failure rate parameter 
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'RLM£UB(i,2) = 0.0', which says that the 44 submodules per memory 
module never fail, eliminates any transient failure contribution by 
the redundant portion of the memory modules, and thus gives the same 
results as the test case defined without internally redundant memory 
modules. 

The fifth test case, listed in Table 7-1, is defined so that both 
R!14(i ,2) and 'MSUB * RLMSUB(i,2)' equal the original failure rates. 
That is, the common logic m each memory module is susceptible to a 
permanent fault with either constant rate 1.0E-4 per hour or 0.18E-4 
per hour, and each active bit line is susceptible to a transient 
fault with either constant rate 2.5E-6 per hour or 4.5E-7 per hour. 

The total system unreliability results for each test case de- 
scribed above is shown in Table 7-2. Note that the test cases have 
been ordered by increasing unreliability results. Also notice that 
in the first four test cases, where the original failure rate was 
divided between the permanent and "effective transient" fault cate- 
gories, as the transient failure rates decrease and thus the perma- 
nent failure rates increase, the total unreliability of the systan 
increases - as would be expected. In the final test case the tran- 
sient failure rate was increased while the permanent failure rate 
was held constant (equal to the original permanent failure rate) , 
which further increased the total system unreliability, as would be 
expected, due to the added transients. 
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Test RLMSUB , RLMSUB RLM , RLM Ratio to Original 


Case 

(1,2) 

(2,2) 

(1,2) 

(2,2) 

RLM 

1 . 

1.670E-6, 

3.000E-7 

3.320E-5, 

6.000E-6 

= 1/3 

2. 

1.250E-6, 

2.250E-7 

5.000E-5, 

9.000E-6 

= 1/2 

3. 

8.330E-7, 

1.500E-7 

6.668E-5, 

1.200E-5 

= 2/3 

4. 

0.0 , 

0.0 

1 . 000E-4 , 

1.800E-5 

= 1 

5. 

2.500E-6, 

4.500E-7 

1.000E-4, 

1.800E-5 

= 1 


Table 7-1 - Failure Rates for PIMP Test Cases 


Test Unreliability 

Case at 100 nun. 

1. 0.8866551E-8 

2. 0. 9490994E-8 

3. 1. 0085668E-8 

4. 1. 1187475E-8 

5. 1. 6950381E-8 

Table 7-2 - FTMP Test Case Results at 100 min. 
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8.0 DESCRIPTION OF MAJOR CARE III DATA STRUCTURES 


This section describes the major data structures and memory manage- 
ment schemes used in CARE III. The contents of the coverage plotting 
files is described along with the major memory management scheme used 
m module COVRGE. Hus scheme controls the memory requirements for 
the numerous single and double-fault function arrays contained m the 
general fault-handling model. The contents of the reliability plot- 
ting file is also described along with the major memory management 
scheme used in module CARE 3. This scheme controls the memory require- 
ments for the numerous functions computed by convolving the coverage- 
model functions with the reliability-model function. 

8.1 COVERAGE PLOTTING FILES DATA STRUCTURE 

Plot file SNGFL is created in program COVRGE if the general 
fault-handling model is chosen - by setting SFLTTYP NAMELIST input 
parameter 'MARKOV = 2', and if plotting is requested - by setting 
input parameter ' CVPLOT = .TRUE.'. 

File SNGFL contains 9326 word blocks. There are NFTYPS ($FLTTYP 
NAMELIST input parameter) blocks contained in the file for a maximum 
of five blocks. Each block consists of the following functions - 
m the order listed below: 
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1 . 


2 . 


3. 


4. 


5. 


P (t) 

B 

PJt) 

B 

P (t) 

F 

P (t) 

L 

P (t) 
DP 


probability single fault is benign 
probability single fault is not benign 
single fault failure intensity 
probability of latent single fault 
single fault detected as permanent intensity. 


In program CW3PLT, each block is read into the following COMMON 
block: 

COMMON /SNGFNC/ PBNG(1800) ,PBGSTP ,NPBGST(64) 

. ,PNBNG(1800) ,PNBSTP ,NPNBST(64) 

. ,PFLD(1800) ,PFSTEP ,NPFSTP(64) 

. ,PLAT (1800) , PLTSTP ,NPLTST(64) 

. ,PDP (1800) ( PD PST P , NPDPST (64) ,LNORLG 


The ith block is the ith fault type ITYP defined m program CAREIN. 
ITYP is used to label the fault type on the plots. 


A time array TMAR(1800) is generated prior to each function 

being plotted using the initial step Size variable and step size 

doubling and halving array corresponding to the function currently 

being plotted. Function P (t) will be used to describe the single- 

B 

fault functions' plotting data structure, and the manner in which 
the time array is generated. Each single-fault function is calcu- 
lated m module COVRGE and stored using the same type of structure. 


P (t) is stored in array PBNG(IT) using a maximum of 1800 
B 

values. Its initial step size is stored m real variable PBGSTP 
and its step size doubling and lialving information is stored in in- 
teger array NPBGST(ISTC) using a maximum of 64 step size changes. 
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The step size may change only by doubling or halving. NPBGST(ISTC) 
defines how many of each doubled (as a positive integer) or halved 
(as a negative integer) steps exist per each step size change. If 
PBGSTP equals 0.2 and *NPBGST(1 - 7) = 3, 2, 4, -2, -4, 3, 2', 

with the remainder of the array filled with zeros, then the time 
array would be computed m program CVGPLT as follows: 


TMAR ( 1) 
TMAR ( 2) 
TMAR ( 3) 
TMAR ( 4) 
TMAR ( 5) 
TMAR ( 6) 
TMAR ( 7) 
TMAR ( 8) 
TMAR ( 9) 
TMAR (10) 
TMAR (11) 
TMAR (12) 
TMAR (13) 
TMAR (14) 
TMAR (15) 
TMAR (16) 
TMAR (17) 
TMAR (18) 
TMAR (19) 
TMAR (20) 
TMAR (21) 


0.0 

0.2 

0.4 

0.6 

1.0 

1.4 
2.2 

3.0 

3.8 

4.6 

5.0 

5.4 

5.6 

5.8 

6.0 
6.2 

6.6 

7.0 

7.4 
8.2 

9.0 


initial step size =0.2 
doubled step size = 0.4 
doubled step size = 0.8 
halved step size =0.4 
halved step size =0.2 
doubled step size = 0.4 
doubled step size =0.8 


Therefore function PBNG(IT), in this truncated example, would con- 
sist of 21 points to use for the plot, with index IT ranging from 
1 to 21. 


Input parameter DBLDF (contained in $FLTTYP NAMELIST) deter- 
mines the amount of points generated when the single-fault functions 
are computed m program COVRGE - the snaller the value given to 
DBLDF the more points generated. Each single-fault function has 
a unique initial step size and step size change description. That 
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is why the time array for each function is not contained m the plot 
file SNGFL. The plot file can contain a maximum of 46,630 words of 
plotting data, if five fault types were defined by the user. If the 
time arrays were included in the file, instead of the step size 
change information, the file would increase to a maximum of 90,005 
words of plotting data. This would practically double its size and 
I/O access time unnecessarily. 

Variable LNORLG, the last word contained m each block of plot- 
ting data, contains the SFLTTYP NAMELIST input parameter 1AXSCV 
defining the Y-axis scale desired for plotting the fault-handling 
functions. Program CVGPLT also uses file COVIN, generated by program 
CAREIN, to retrieve the system tree title to help identify the cur- 
rent run, and the TBA5E variable specifying the time base of the 
plots: 'HRS 'MINS', 'SECS' or 'MSEC'. 

File DBLFL contains 1865 word blocks. There are NFTYPS squared 
blocks contained in the file - for a maximum of 25 blocks. Each 
block consists of the following function: 

p (t) - double fault failure intensity. 

DF 

In program CVGPLT , each block is read into the following COMMON 
block: 

COMMON /DBLFNC/ PDFAR(1800) ,PDFSTP ,NPDFST(64) 

The ith block is the ith double-fault type pair (ITYP,JTYP), where 
JTYP varies the fastest. For example, if three fault types had been 
defined m program CAREIN, the double-fault failure intensity func- 
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tion, computed per fault type pair, would be written to DBLFL, in 


module COVRGE, ordered (1,1), (1,2), (1,3), (2,1), (2,2), (2,3), 
(3,1), (3,2), (3,3). 

A time array 1MAR(1800) is generated prior to each double-fault 
function being plotted using the initial step size variable PDFSTP 
and the step size change description NPDFST(64). The time array 
is generated in the exact same manner as described above for the 
single-fault functions. 

The plot file DBLFL can contain a maximum of 46,625 words of 
plotting data, if five fault types were defined. In general there 
are fewer double-fault functions to plot than single-fault functions 
because there are five times NFTYPS single-fault functions and 
NFTYPS squared double-fault functions, in files SNGFL and DBLFL 
respectively. At its maximum size, it would contain 90,000 words of 
plotting data if the time arrays were passed in the plotting file. 
DBLFL does not contain the IAXSCV input parameter. Program CVGPLT 
uses variable LNORLG from file SNGFL for the choice of the Y-axis 
scale. 

8.2 RELIABILITY PLOTTING FILE DATA STRUCTURE 

Plot file PLTFL is created in program CARE3, if input parameter 
RLPLOT is set .TRUE, in $STAGES NAMELIST. File PLTFL contains 260 
words of plotting data that consists of one 195 word block and one 
65 word block. The first block contains the CARE3 sunraary results: 
"Q SUM", "P* SUM", and "Q+P* SUM" read by program RELPLT into COMMON 
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/PLTCOM/ QLTSUM(65) ,PSTSUM(65) ,QPSTSM(65). Hie second block con- 
tains the time values corresponding to the summary functions' results 
and is read into array TMA.<(65) contained in the following COMMON 
block: 


C 

C 


COMMON /STEPCM/ 

ITSTPS 

» 

MAXSTP 

t 

RELSTP 

, TBASE 

9 

TMAR (65) 

9 

NSTGRN 

9 

KWT 

, PSTRNC 

9 

PRCODE 

9 

RLPLOT 

9 

IAXSRL 

, QPTRNC 

9 

CPLFLG 

9 

SYSMNT 

9 

TBCF 


CHARACTER* 4 

PRCODE 






LOGICAL 

RLPLOT 

9 

SYSMNT 

9 

CPLFLG 



Due to the unequal step sizes used in computing the enhanced 
CARE3 functions, if input parameter LGTMST was set .TRUE, in 
$FLTTYP NAMELIST, the functions' corresponding time values are writ- 
ten to file PLTFL, and hence no longer generated in program RELPLT. 
This increases the size of file PLTFL by only 65 words since all 
three functions were computed using the same step sizes. 

Program RELPLT also uses file RELIN, generated by program 
CAREIN, to retrieve the system tree title to help identify the cur- 
rent run, the TBASE variable specifying the time base of the plots, 
and input parameter IAXSRL to determine the Y-axis plotting choice. 

8.3 COMMON BLOCK BXYCOM DATA STRUCTURE 


The purpose of this section is to detail the data structure and 
memory management scheme used for the arrays in COMMON /BXYCOM/ 
contained in module CARE3. Therefore the way the data is handled 
rather than what the data is will be described m detail. (See refs. 
5, 6 and 8 for detailed data descriptions.) 
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Table 8-1 is a partial listing of COMMON block BXYCOM including 
a brief description of the arrays and the contents of the COMMON 
block. The equivalenced arrays are not shown here but are listed in 
Tables 8-2, 8-3, 8-4, 8-5 and 8-6 that follow the COMMON block list- 
ing. 


The tables' format is structured so that all pertinent array 
equivalences are shown in pairs. The pairs consist of the name and 
index of the first word of the array followed by the name and index 
of the last word of the array. The variables used for the indices 
arc also listed m the tables along with the segment number 'SEG'. 

This number is used to manage the data in main memory and when buf- 
fering is required. SUBROUTINE BUFQAT manages all data indexed using 
a segment number and determines whether buffering to disk is required. 

For the tables that contain segment numbers: Tables 8-2, 8-5 and 
8-6, three levels of array equivalences are shown. The array listed 
in the first column is the array contained in the COMMON block state- 
ment - either NXYAR or BXYAR; the array listed m the second column 
is the equivalenced array used to buffer the data using SUBROUTINE 
BUFDAT; and the array (s) listed in the third column are the equiva- 
lenced array (s) used in the code when generating and accessing the 
data. Tables 8-3 and 8-4 contain arrays that are never buffered to 
disk while module CARE3 is executing. The first column of these 
tables contains the COMMON block array name NXYAR or BXYAR equiva- 
lenced to array (s) used in the code when generating and accessing the 
data. If desired, see module CARE3 for the DIMENSION and EQUIVALENCE 
code statements that define the arrays listed in these tables. 
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Qit it it it it it it it it it it it it it it it it it it it it it it it it it it it it -k it it it it it it it it it it it it it it it it it -k it it ^ it it it it it it it it it it it it it it •k it it * * 


c* 




* 

c* 

COtWON 

block 

: BXYCOM 

* 

c* 




* 

c* 

NXYAR 

= 

BUFFER ARRAY FOR NXX AND NXY DATA 

★ 

c* 




* 

c* 

BFNXX 

= 

BUFFER FOR NXX DATA 

* 

c* 

BFNXY 

= 

BUFFER FOR NXY DATA 

* 

c* 




★ 

c* 

HLTP 

- 

1. / SUM( HL (XI .P,T) ) 

★ 

c* 

HNBP 

3C 

SUM( HNB(XI.P,T) ) 

★ 

c* 

HNBT 

= 

SUM( HNB (XI .T,T) ) 

* 

c* 

HBNG 

= 

HB(X,I,T) 

* 

c* 

HBNGSB 

~ 

HB(X,I.T,T) FOR STAGES WITH INTERNALLY 

★ 

c* 



REDUNDANT MODULES 

★ 

c* 

HDPTIN 

= 

INTEGRATED HDP(X,I.T,T) 

★ 

c* 

FIUP 

= 

Sm^l( LAM(XI .P,T) ) 

* 

c* 

FLMT 

= 

SUM( LAM (XI .T,T) ) 

★ 

c* 




* 

c* 

RXAR 

= 

R (X:T) 

* 

c* 

CMPRAR 

= 

1.0 COMPLEMENT OF 'RXAR' 

* 

c* 

SMCLAM 

= 

SUM OF 'CLAM'S 

* 

c* 

AXAR 

S 

A(X:T) 

* 

c* 

SRPSTF 

= 

SUBRUN P* FUNCTION (T:X) 

★ 

c* 

FPMX 

= 

P (MUX, T: LX) 

* 

c* 

PSLX 

= 

P*(T:L-1X) * (NX-LX+1) 

* 

c* 

IJSGIN 

= 

NUMBER ASSIGNED TO A PAIR OF C.P. STAGES 

★ 

c* 




* 

c* 

BXYAR 

= 

BUFFER ARRAY FOR BXX AND BXY DATA 

★ 

c* 




* 

c* 

BFBXX 

= 

BUFFER FOR BXX DATA 

★ 

c* 

BFBXY 

= 

BUFFER FOR BXY DATA 

★ 

c* 




★ 

c* 

IQXNOP 

= 

NUMBER OF 'IN-USE' MODULES 

* 

c* 

KQXNOP 

= 

INDEX OF 'IN-USE' MODULES 

★ 

c* 

KFSTG 

= 

NUMBER OF THE FIRST STAGE IN A SUBRUN 

★ 

c* 




* 

c* 

KNT 

= 

C.P. COUNT FOR A SUBRUN 

it 

c* 

ICSTG 

= 

NUMBER OF COUPLED STAGES IN A SUBRUN 

it 

c* 

NCSTG 

= 

NUMBER OF STAGES IN A SUBRUN 

it 

c* 

IISTG 

= 

POINTER INTO KNT ARRAY 

it 

c* 

IUSTG 

= 

POINTER INTO KNT ARRAY 

★ 

c* 




* 

c* 

NXX 

= 

N DATA FOR XX CASE 

* 

c* 

NINXX 

= 

INDEX OF CURRENT 'SEG' FOR NXX DATA 

* 

c* 

NBNXX 

= 

NUMBER OF CURRENT BLOCK FOR NXX DATA 

★ 

c* 

NSNXX 

= 

NUMBER OF 'SEG' / BLOCK FOR NXX DATA 

* 

c* 

NWNXX 

= 

NUMBER OF WORDS / BLOCK FOR NXX DATA 

★ 

c* 




* 


(COMMON block BXYCOM continued on following page) 
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c* 

NXY 

= 

N DATA FOR XY CASE 



★ 

c* 

NINXY 

= 

INDEX OF CURRENT ’SEG' FOR 

NXY 

DATA 

★ 

c* 

NBNXY 

= 

NUMBER OF CURRENT BLOCK FOR 

NXY 

DATA 

★ 

c* 

NSNXY 

= 

NUMBER OF 'SEG' / BLOCK FOR 

NXY 

DATA 

* 

c* 

NWNXY 

= 

NUMBER OF WORDS / BLOCK FOR 

NXY 

DATA 

★ 

c* 






* 

c* 

BXX 

= 

B DATA FOR XX CASE 



★ 

c* 

XXDFP 

= 

8-4 TERM FOR SUMA - P,X,X 



★ 

c* 

XXDFT 

= 

8-4 TERM FOR SUMA - T,X,X 



* 

c* 

XXN3P1 

= 

8-5 TERM FOR SUMC - P,X,X 



★ 

c* 

XXNBTl 

= 

8-5 TERM FOR SUMC - T,X,X 



★ 

c* 

XXNBP2 

= 

8-5 TERM FOR SUMA - P,X,X 



* 

c* 

XXNBT2 

= 

8-5 TERM FOR SUMA - T,X,X 



* 

c* 

XXFLP 

= 

A' TERM FOR SUMA - P,X,X 



it 

c* 

XXFLT 

= 

A' TERM FOR SUMA - T,X,X 



* 

c* 

NIBXX 

= 

INDEX OF CURRENT 'SEG' FOR 

BXX 

DATA 

* 

c* 

NBBXX 

= 

NUMBER OF CURRENT BLOCK FOR 

BXX 

DATA 

★ 

c* 

NSBXX 

= 

NUMBER OF 'SEG' / BLOCK FOR 

BXX 

DATA 

★ 

c* 

NWBXX 

= 

NUMBER OF WORDS / BLOCK FOR 

BXX 

DATA 

* 

c* 






* 

c* 

BXY 

= 

B DATA FOR XY CASE 



★ 

c* 

XYDFP 

= 

8-4 TERM FOR SUMA - P,X,Y 



* 

c* 

YXDFP 

= 

8-4 TERM FOR SUMA - P,Y,X 



* 

c* 

XYDFT 

= 

8-4 TERM FOR SUMA - T,X,Y 



* 

c* 

YXDFT 

= 

8-4 TERM FOR SUMA - T,Y,X 



★ 

c* 

XYNBP1 

= 

8-5 TERM FOR SUMC - P,X,Y 



* 

c* 

YXNBP1 

= 

8-5 TERM FOR SUMC - P,Y,X 



* 

c* 

XYNBT1 

= 

8-5 TERM FOR SUMC - T,X,Y 



* 

c* 

YXNBT1 

=r 

8-5 TERM FOR SUMC - T,Y,X 



* 

c* 

XYNBP2 

= 

8-5 TERM FOR SUMA - P,X,Y 



* 

c* 

YXN3P2 

= 

8-5 TERM FOR SUMA - P,Y,X 



* 

c* 

XYN3T2 

= 

8-5 TERM FOR SUMA - T,X,Y 



* 

c* 

YXNBT2 

= 

8-5 TERM FOR SUMA - T,Y,X 



* 

c* 

NIBXY 

= 

INDEX OF CURRENT 'SEG' FOR 

BXY 

DATA 

★ 

c* 

NBBXY 

= 

NUMBER OF CURRENT BLOCK FOR 

BXY 

DATA 

it 

c* 

NSBXY 

= 

NUMBER OF 'SEG' / BLOCK FOR 

BXY 

DATA 

it 

c* 

N\i/BXY 

= 

NUMBER OF WORDS / BLOCK FOR 

BXY 

DATA 

it 

c* 






it 

c* 

INXY 

= 

UNIT NUMBER OF NXX AND NXY DATA 


it 

c* 

IBXY 

= 

UNIT NUMBER OF BXX AND BXY DATA 


it 

c* 






it 


it ^ it it it it it it it it it it it it it it it -k it it it it it -k it it it it it it it it it -k it it if it it it it it it it it it it -k it it it it it -k it it it it it it it it it -k it -k it it it it 

c* * 

COMMON /BXYCOM / INXY , IBXY 
. , NIBXX, NBBXX, NSBXX, NWBXX 

, NIBXY , NBBXY , NSBXY, NWBXY 
. , NINXX, NBNXX, NSNXX, NWNXX 

, N1NXY, NBNXY, NSNXY , NWNXY 
, NXYAR (30830) , BXYAR(33001) 

C* * 

Q * ********************************************************************** 


Table 8-1 - Description of BXYCOM Variables 
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ARRAY EQUIVALENCES 


INDEXED BY 


'SEG' 


NXYAR ( 

1) 

= 

BFNXX 

( 1, 1) 

= 

NXX 

( 1, 1) 

(KQX,NINXX) 

1 

NXYAR ( 

10) 

= 

BFNXX 

(10, 1) 

= 

NXX 

(10, 1) 



NXYAR ( 

11) 

= 

BFNXX 

( 1, 2) 


NXX 

( 1, 2) 


2 

NXYAR ( 

20) 

= 

BFNXX 

(10, 2) 

= 

NXX 

(10, 2) 




• 

• 



• 

• 



• 

• 


3-19 

NXYAR ( 

191) 

= 

BFNXX 

( 1,20) 

S 

NXX 

( 1,20) 


20 = N5NXX 

NXYAR ( 

200) 

5= 

BFNXX 

(10,20) 

= 

NXX 

(10,20) 



NXYAR ( 

201) 

= 

BFNXY 

( 1, 1) 

= 

NXY 

( 1, 1) 

(KQXY,N1NXY) 

1 

NXYAR ( 

300) 

= 

BFNXY 

(100, 1) 

= 

NXY 

(100, 1) 



NXYAR ( 

301) 

= 

BFNXY 

( 1, 2) 

= 

NXY 

( 1, 2) 


n 

NXYAR ( 

400) 

= 

BFNXY 

(100, 2) 

= 

NXY 

(100, 2) 




• 

• 



• 

• 



• 

• 


3-49 

NXYAR ( 

• 

5101) 


BFNXY 

• 

( 1,50) 

s 

NXY 

• 

( 1,50) 


50 = NSNXY 

NXYAR ( 

5200) 

= 

BFNXY 

(100,50) 

= 

NXY 

(100,50) 




Table 

8-2 - 

N-XY Critical 

Pair Counts 

Per Subrun 
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ARRAY EQUIVALENCES 


INDEXED BY 


NXYAR ( 5201) 

= 

HLTP 

( 1, 1) 




(ISTG, IT) 

NXYAR ( 6500) 

= 

HLTP 

(20,65) 





NXYAR ( 6501) 

= 

HNBP 

( 1, 1) 




(ISTG, IT) 

NXYAR ( 7800) 

= 

HNBP 

(20,65) 





NXYAR ( 7801) 

= 

HNBT 

( 1, 1) 




(ISTG, IT) 

NXYAR ( 9100) 

= 

HNBT 

(20,65) 





NXYAR ( 9101) 

S 

HBNG ( 

1,1, 1) 

= 

HDPTIN ( 

1,1, 1) 

(ISTG, ICAT, IT) 

NXYAR (15600) 

= 

HBNG (20,5,65) 

= 

HDPTIN (20,5,65) 


NXYAR (15601) 

= 

FLMP 

(1,1) 




(ISTG, IT) 

NXYAR (16900) 

= 

FLMP 

(1,1) 





NXYAR (16901) 

= 

FLMT 

( 1, 1) 




(ISTG, IT) 

NXYAR (18200) 

= 

FLMT 

(20,65) 





NXYAR (18201) 

= 

RXAR 

( 1, 1) 




(ISTG, IT) 

NXYAR (19500) 

= 

RXAR 

(20,65) 





NXYAR (19501) 

= 

CMPRAR 

( 1, 1) 

= 

SMCLAM 

( 1, 1) 

(ISTG, IT) 

NXYAR (20800) 

= 

CMPRAR 

(20,65) 

= 

SMCLAM 

(20,65) 


NXYAR (20801) 

= 

AXAR 

( 1, 1) 

= 

SRPSTF 

( 1, 1) 

(ISTG, IT) , 

NXYAR (22100) 

= 

AXAR 

(20,65) 

= 

SRPSTF 

(65,20) 

(IT, ISTG) 

NXYAR (22101) 

= 

FEMX ( 1 

, 1, 1) 




(ISTG, 1MUX, IPMX) or 

NXYAR (24100) 

= 

FPMX (20 

,10,10) 




(JSTG, IMUY, JPMY) 

NXYAR (24101) 

= 

PSLX 

( 1) 




(ISTG) 

NXYAR (24120) 

= 

PS LX 

(20) 





NXYAR (24121) 


1JSGIN 

( 1) 




(I JSTG) 

NXYAR (24330) 

= 

IJSGIN 

(210) 





NXYAR (24331) 

= 

HBNGSB ( 

1,1, 1) 




(ISTG, ICAT, IT) 

NXYAR (30830) 

= 

HBNGSB (20, 1,65) 






Table 8-3 - (I5TG) Single-Fault Reliability Functions Per Subrun 
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ARRAY EQUIVALENCES 


INDEXED BY 


BXYAR ( 1) 

BXYAR ( 200) 

BXYAR ( 201) 

BXYAR ( 400) 

BXYAR ( 401) 

BXYAR ( 402) 

BXYAR (14401) 

BXYAR (14402) 

BXYAR (14403) 

BXYAR (14404) 
BXYAR (14473) 

BXYAR (144 74) 
BXYAR (14543) 

BXYAR (15000) 

Table 8-4 - 


IQXNOP ( 1, 1) 
IQXNOP (10,20) 

(KQX, ISTG) or 
(KQY, JSTG) 

KQXNOP ( 1, 1) 
KQXNOP (10,20) 

(IMUX, ISTG) 
(1MUY, JSTG) 

KFSTG 


KNT( 1, 1, 1) 
KNT (70,20,10) 

(IIDX, ISTG, KQX) or 
(IIDX, JSTG,KQY) 

ICSTG 

(Not Used m CARE3) 

NCSTG 

(Not Used m CARL 3) 

IISTG ( 1) 

IISTG (70) 

(Not Used 
in CARE 3) 

IUSTG ( 1) 

IUSTG (70) 

(ISTG) or 
(ISTG+1) 


(Unused Portion of 
BXYAR Buffered to 
and from Unit 14) 


Portion of BXYAR Generated m CAREIN Module Per Subrun 
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ARRAY EQUIVALENCES 


INDEXED BY 


'SEG' 


BXYAR ( 

402) = BFBXX ( 1, 1) 

= 

BXX 

( 1, 1) 

(IMUX,NIBXX) 

1 


BFBXX ( 10, 1) 

= 

BXX 

(10, 1) 




BFBXX ( 11, 1) 

= 

XXDFP 

( 1, 1) 

(IT,NIBXX) 

1 


BFBXX ( 75, 1) 

= 

XXDFP 

(65, 1) 




BFBXX ( 76, 1) 

= 

XXDFT 

( 1, 1) 

(IT,NIBXX) 

1 


BFBXX (140, 1) 

= 

XXDFT 

(65, 1) 




BFBXX (141, 1) 

= 

XXNBP1 ( 1, 1) 

(IT,NIBXX) 

1 


BFBXX (205, 1) 

= 

XXNBP1 (65, 1) 




BFBXX (206, 1) 

= 

XXNBT1 ( 1, 1) 

(IT,NIBXX) 

1 


BFBXX (270, 1) 

= 

XXNBT1 (65, 1) 




BFBXX (271, 1) 

= 

XXNBP2 ( 1, 1) 

(1T,NIBXX) 

1 


BFBXX (335, 1) 

= 

XXNBP2 (65, 1) 




BFBXX (336, 1) 

= 

XXNBT2 ( 1, 1) 

(IT,NIBXX) 

1 


BFBXX (400, 1) 

= 

XXN3T2 

(65, 1) 




BFBXX (401, 1) 

= 

XXFLP 

( 1, 1) 

(IT,NIBXX) 

1 


BFBXX (465, 1) 

= 

XXFLP 

(65, 1) 




BFBXX (466, 1) 

= 

XXFLT 

( 1, 1) 

(IT,NIBXX) 

1 

BXYAR ( 

931) = BFBXX (530, 1) 

= 

XXFLT 

(65, 1) 



BXYAR ( 

932) = BFBXX ( 1, 2) 

= 

BXX 

( 1, 2) 

(IMUX,NIBXX) 

2 


BFBXX ( 10, 2) 

• 


BXX 

(10, 2) 

• 




• 

BFBXX (466, 2) 

— 

XXFLT 

• 

( 1, 2) 

(IT,NIBXX) 

2 

BXYAR ( 

1461) = BFBXX (530, 2) 

= 

XXFLT 

(65, 2) 




• 

• 



• 

• 


3-19 

• 

BXYAR (10472) = BFBXX( 1,20) 

= 

BXX 

( 1,20) 

(IMUX,NIBXX) 

20 


BFBXX ( 10,20) 

• 

= 

BXX 

(10,20) 




• 

BFBXX (466,20) 

= 

XXFLT 

( 1,20) 

(1T,NIBXX) 

20 = NSBXX 

BXYAR (11001) = BFBXX (530, 20) 

= 

XXFLT 

(65,20) 




Table 8-5 - (ISTG,ISTG) Double-Fault Reliability Functions Per Subrun 
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ARRAY EQUIVALENCES 


INDEXED BY 'SEG' 


BXYAR (11002) = BFBXY ( 1, 1) 

= 

BXY ( 1, 1) 

(KMXY,NIBXY) 

1 

BFBXY (100, 1) 

= 

BXY (100, 1) 



BFBXY (101/ 1) 

= 

XYDFP ( 1, 1) 

(1T,NIBXY) 

1 

BFBXY (165, 1) 

= 

XYDFP (65, 1) 



BFBXY (166, 1) 

= 

YXDFP ( 1, 1) 

(IT,NIBXY) 

1 

BFBXY (230, 1) 

= 

YXDFP (65, 1) 



BFBXY (231, 1) 

= 

YXDFT ( 1, 1) 

(IT,NIBXY) 

1 

BFBXY (360, 1) 

= 

YXDFT (65, 1) 



BFBXY (361, 1) 


XYNBP1 ( 1, 1) 

(IT, N I BXY) 

1 

BFBXY (425, 1) 

= 

XYNBP1 (65, 1) 



BFBXY (426, 1) 


YXNBPl ( 1, 1) 

(IT,NIBXY) 

1 

BFBXY (490, 1) 

- 

YXNBP1 (65, 1) 



BFBXY (491, 1) 

= 

XYNBT1 ( 1, 1) 

(IT,NIBXY) 

1 

BFBXY (555, 1) 

= 

XYNBT1 (65, 1) 



BFBXY (556, 1) 

= 

YXNBTl ( 1, 1) 

(IT,NIBXY) 

1 

BFBXY (620, 1) 

S 

YXNBTl (65, 1) 



BFBXY (621, 1) 

= 

XYNBP2 ( 1, 1) 

(IT,N1BXY) 

1 

BFBXY (685, 1) 

= 

XYNBP2 (65, 1) 



BFBXY (686, 1) 

= 

YXNBP2 ( 1, 1) 

(IT,NIBXY) 

1 

BFBXY (750, 1) 

= 

YXNBP2 (65, 1) 



BFBXY (751, 1) 

= 

XYNBT2 ( 1, 1) 

(IT,NIBXY) 

1 

BFBXY (815, 1) 

= 

XYNBT2 (65 , 1) 



BFBXY (816, 1) 

= 

YXNBT2 ( 1, 1) 

(IT,N1BXY) 

1 

BXYAR (11881) = BFBXY (880, 1) 

= 

YXNBT2 (65, 1) 



BXYAR (11882) = BFBXY ( 1, 2) 

= 

BXY ( 1, 2) 

(KMXY,NIBXY) 

2 

BFBXY (100, 2) 

• 


BXY (100, 2) 

• 



• 

BFBXY (816, 2) 

— 

• 

YXNBT2 ( 1, 2) 

(IT,NIBXY) 

2 

BXYAR (12761) = BFBXY (880, 2) 

= 

YXNBT2 (65, 2) 



• 

• 


• 

• 


3-24 

• 

BXYAR (32122) = BFBXY ( 1,25) 

= 

• 

BXY ( 1,25) 

(KMXY,NIBXY) 

25 

BFBXY (100,25) 

• 

= 

BXY (100,25) 



• 

BFBXY (816, 25) 

= 

YXNBT2 ( 1,25) 

(IT,NIBXY) 

25 = NSBXY 

BXYAR (33001) = BFBXY (880, 25) 

= 

YXNBT2 (65,25) 




Table 8-6 - (ISTG,JSTG) Double-Fault Reliability Functions Per Subrun 
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COMMON /BXYCOM/ contains two large buffer arrays and several data 
controlling variables and constants described Qelow: 

1) NXYAR (30830) is the buffer array containing the N-XY crit- 
ical-pair counts (see Table 8-2), and the single-fault reli- 
ability function arrays (see Table 8-3); 

2) BXYAR (33001) is the buffer array containing the B-XY data 
generated m the CAREIN module and used in the CARE3 module 
(see Table 8-4), the B-XY probabilities that critical pairs 
exist between specific modules in stage x and stage y, and 
the double-fault reliability functions (see Tables 8-5 and 
8 - 6 ); 

3) INXY is the unit number (= 18) of the disk file used to 
hold the buffer BFNXY array (see Table 8-2) containing the 
NXY critical-pair counts, if tne number of critical-pair 
stage combinations (ISTG,JSTG) exceed constant NSNXY (= 50) 
per subrun; 

4) IBXY is the unit number (= 19) of the disk file used to 
hold the buffer BFBXY array (see Table 8-6), if the number 
of (ISTG, JSTG) double-fault pairs of stages exceeds con- 
stant NSBXY (= 25) per subrun; 

5) NSNXX is the constant (= 20) defining the number of seg- 
ments 'SEG' per block used when generating the buffer BFNXX 
array (see Table 8-2); 

6) NWNXX is the constant (= 200) defining the number of words 
per block used when generating the buffer BFNXX array (see 
Table 8-2); 

7) NSNXY is the constant (= 50) defining the number of seg- 
ments 'SEG' per block used when generating and buffering 
the 3FNXY array (see Table 8-2) ; 

8) NWNXY is the constant (= 5000) defining the number of words 
per block used when generating and buffering the BFNXY array 
(see Table 8-2); 

9) NSBXX is the constant (= 20) defining the number of seg- 
ments 'SEG' per block used when generating the buffer BFBXX 
array (see Table 8-5) ; 

10) NWBXX is the constant (= 10600) defining the number of words 
per olock used when generating the buffer BFBXX array (see 
Table 8-5); 

11) NSBXY is the constant (= 25) defining the number of seg- 
ments 'SEG' per block used when generating and buffering 
the BFBXY array (see Table 8-6); 
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12) NWBXY is the constant (= 22000) defining the number of words 
per block used when generating and buffering the BFBXY array 
(see Table 8-6); 


13) NINXX is the index variable of the current 'SEG' of the NXX 
data; it ranges from 1 to NSNXX (see Table 8-2); 

14) NBNXX is the number of the current block for the NXX data; 
no coded upper limit exists for NBNXX; 

15) NINXY is the index variable of the current 'BEG' of the NXY 
data; it ranges from 1 to NSNXY (see Table 8-2); 

16) NBNXY is the nimber of the current block for the NXY data; 
no coded upper limit exists for NBNXY; 


17) 


NIBXX is the index variable of the current 'SEG' of the BXX 
data; it ranges from 1 to NSBXX (see Table 8-5); 


18) NBBXX is the number of the current block for the BXX data; 
no coded upper limit exists for NBBXX; 

19) NIBXY is the index variable of the current 'SEG' of the BXY 
data; it ranges from 1 to NSBXY (see Table 8-6); 


20) NBBXY is the number of the current block for the BXY data; 
no coded upper limit exists for NBBXY. 


Tables 8-2 and 8-3 show that NXYAR is partitioned into three sec- 
tions. The first 200 (NWNXX) words of NXYAR contain the intra-staye 
(stages with modules that are critically coupled to other modules m 
the same stage) critical-pair counts. A maximum of 20 (NSNXX) such 
stage pairings or segments, indexed by NINXX, can be stored m main 
memory per subrun. Since the maximum number of stages per subrun is 
20 , and thus the maximum number of pairings is 20, no buffering is 
required of the NXX array. 

The next 5000 (NWNXY) words of NXYAR contain the inter-stage 
(stages with modules that are critically coupled to modules in a dif- 
ferent stage) critical-pair counts. A maximum of 50 (NSNXY) such 
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stage pairings or segments, indexed by NINXY, can by stored in main 
memory per subrun before buffering to disk is required. When the 
number of separate critically coupled stages in a given subrun ex- 
ceeds 10, buffering to disk of the NXY data will be necessary. The 
number of (ISTG,JSTG) pairs, with ISTG less than J3TG, equals 55 for 
11 critically coupled stages and increases to 190 for 20 critically 
coupled stages (see Table 8-7 below) . Thus a maximum of four blocks 
would oe written initially to unit INXY, for a given subrun contain- 
ing 20 critically coupled stages, and read per fault vector computa- 
tion. 


Number of Critically Number of (ISTG, JSTG) 

Coupled Stages pairs where ISTG < JSTG 


2 

1 

3 

3 

4 

6 

5 

10 

6 

15 

7 

21 

8 

28 

9 

36 

10 

45 

11 

55 

12 

66 

13 

78 

14 

91 

15 

105 

16 

120 

17 

136 

18 

153 

19 

171 

20 

190 


Table 8-7 - Number of Stage Pairs Given 

Number of Critically Coupled Stages 
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The remaining 25,630 words of NXYAR contain the single-fault 
reliability functions per subrun. These are the functions that are 
generated using the single-fault coverage moment functions, passed 
from module COVRGE, convolved with the reliability -model function. 

No buffeting to disk is required of the arrays contained in this 
portion of NXYAR. 

Tables 8-4, 8-5 and 8-6 show that QXYAR is also partitioned into 
three sections. These partitions overlap because the data is re- 
quired at different times during the execution of CARE3. Hie first 
15,000 words of BXYAR contain the critical-pair data per subrun gen- 
erated in module CAREIN. Tins data is used to generate the NXX and 
NXY arrays contained m NXYAR. Once these arrays are computed, 

BXYAR (402) through (15000) can be used for the double-fault reliabil- 
ity functions (see Tables 8-5 and 8-6). Notice that words BXYAR 
(14402) through (14473) and BXYAR(14544) through (15000) do not con- 
tain data used in module CARE3, while the later range of buffered 
words are not used in any module. If array IUSTG(70) were moved di- 
rectly below array KNT (70,20,10) , m COMMON /BXYCOM/ m both modules 
CAREIN and CARE3, and only BXYAR (1) through (14471) were buffered to 
unit 14, 529 less words would have to be buffered to and from disk 
per subrun containing critically coupled stages. 

The second partition of BXYAR consists of words BXYAR (402) 
through (11001) and contains the BXX function array and the intra- 
stage double- fault reliability functions. These are the functions 
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computed using the double-fault coverage moment functions convolved 
with the reliability-model function. These function arrays begin 
with the letters XX (see Table 8-5) . A maximum of 20 (NSBXX) such 
stage pairings or segments, indexed by NIBXX, can be stored in main 
memory per subrun. No buffering to disk is ever required of this 
data since 20 pairings is the maximum number possible per subrun. 

The double-fault reliability function arrays that begin with the 
letters XX are dimensioned (530,1) yet are indexed by IT (time step: 

1 to 65) and NIBXX (segment number: 1 to 20). The (530,1) DIMENSION 
statement is necessary since there are 530 words contained in each 
segment of this data type. For example, array XXDFP (1-65, 3) is two 
segments from the beginning of XXDFP (1-65, 1) , l.e. XXDFP(1,3) is 
(2 * 530) words offset from XXDFP(1,1). 

The third partition of BXYAR consists of words BXYAR(11002) 
through (33001) and contains the BXY function array and the inter- 
stage double-fault reliability functions. A maximum of 25 (NSBXY) 
such stage pairings or segments, indexed by NIBXY, can De stored in 
main memory per subrun before buffering to disk is required. When 
the number of separate critically coupled stages m a given subrun 
exceeds seven, buffering to disk of the BFBXY buffer (see Table 8-6) 
will be necessary. Hie number of (ISTG,JSTG) pairs, with 1STG less 
than JSTG, equals 28 for eight critically coupled stages and increases 
to 190 for 20 critically coupled stages (see Table 8-7). Thus a maxi- 
mum of eight blocks would be written initially to unit IBXY, for a 
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given subrun containing 20 critically coupled stages, and read per 
fault vector computation. 

The inter-stage double-fault reliability function arrays, con- 
tained in this partition, are dimensioned (880,1) because there are 
880 words contained per segment for this data type. Given an (ISTG, 
JSTG) pair, with ISTG less than JSTG, the arrays that begin with the 
letters XY are created using the stage pair ordering (JSTG, ISTG) ; 
the arrays that begin with the letters YX are created using the stage 
pair ordering (ISTG, JSTG) . 

When modeling a large system, if separate critical pair trees 
are defined so that each critical-pair tree contains a maximum of 
seven critically coupled stages (see ref. 2), no buffering to and 
from disk will be necessary for any of the functions described above. 
This will enable the program to execute as fast as is possible. 
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9.0 ADDITIONAL TESTING OF USER INPUT VALUES 


Several additional warning/error checks and messages were added 
to SUBROUTINE VLDNML in module CARE IN to aid the user in defining a 
valid input stream. The additional checks deal with the following 
six areas: 

1) Ratio of ALP (l) to BET(i) should be less than 1000 to 
avoid COVRGE numerical instability problems. - WARNING 

2) Reciprocal of failure rates X to the power u) should be 

at least three orders of magnitude greater than the tran- 
sition times in the fault-handling model. - WARNING 

3) Coverage plot files SNGFL and DBLFL can only be generated 
using the general coverage model (MARKOV = 2) . - WARNING 

4) Runs with mission times of one hour or more (FT >= 1 hour) 
should use the logarithmic time step method for all func- 
tion computations (LGTMST = .TRUE.) for greater accuracy 
without increasing execution time. - WARNING 

5) A DEL ( i ) (or RHO(i)) value of zero is illegal if the 
DEL (l) (or RHO ( l ) ) parameter is specified as a uniform 
rate function: IDELF(i) = 2 (or IRHOF(i) = 2) . - ERROR 

6) Permanent fault types only must be assigned to stage (s) 
with internally redundant modules. The fault type(s) 
assigned to the redundant submodules, using JSBTYP(i,x), 
and the fault type(s) assigned to the non-redundant por- 
tion of the module or the redundant portion where no re- 
dundant submodules remain, using JTYP(i,x), must have 
ALP ( l ) = 0.0. - ERROR 

Valid range checks were also added to SUBROUTINE VLDNML for all 
new input parameters added during this enhancement phase. 


The modification to the FTMP test case, contained m figure 9-1, 
was one of the test cases used to check the added error tests. The 
output generated by CAREIN using the error filled CREIN input file 
is shown in figure 9-2 . 
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10.0, 

1.0E+6, 

0.0, 

1.0, 

1.0, 

0.0, 

10.0, 

36.0, 

10.0, 

0.0, 

0.0, 

0.0, 

0.0, 

0.0, 

0.0, 

1, 

1, 

1, 

1, 

1, 

1, 

1, 

1, 

1, 

1.0, 

1.0, 

1.0, 

1.0, 

1.0, 

0.0, 

1.0, 

1.0, 

1.0, 

0.05, 

1.0E-5, 

.TRUE., .TRUE 

15, 

9, 

5, 

11, 

5, 

3, 

0, 

44, 

0, 

0, 

40, 

0, 

TRUE., 

9 

.FALSE., 

9 9 9 9 

.TRUE. , 



l.OE-1, 0.18E-1, 
l.OE-4, 0.18E-4, 

1.0E-6, 

» I 

t r 
i 

l!oE-l, 0.18E-1, / 

100.0, 50, 2, .TRUE., .TRUE., , 1.0E-10/ 

PIMP ARCHITECTURE - 15 PROCESSORS, 9 MEMORY MODULES, 5 BUSES 
WITH CRITICAL FAULT PAIRS AND INTERNALLY REDUNDANT MLMORY MODULES. 
DECEMBER, 1984 - With (MSUB*RLMSUB) + RIM = ORIGINAL LAMBDA 

and RIM = 2 * ORIGINAL LAMBDA / 3 

13 4 4 
4 0 12 3 


. (Critical Pair Fault-Tree not listed) 


Figure 9-1 - F'IMP Modified Test Case 

(containing input errors) 
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“WARNING** 


** WARNING** 


* ‘WARNING** 


“WARNING** 


“WARNING** 


* ‘WARNING** 


(CARLIN 


CCCCC 

A 

RRRR 

EEEEE 

IIIIIIIIIIIIIII 

C 

A A 

R 

R 

E 

I 

I I 

c 

A 

A 

RRRR 

EEE 

I 

I I 

c 

A AAA A 

R 

R 

E 

I 

I I 

ccccc 

A 

A 

R 

R 

EEEEE 

IIIIIIIIIIIIIII 


RATIO OF TRANSITION PARAMETERS ALP = 1.000e+06 AND BET = 

1.000e+00, FOR FAULT TYPE 2, EXCEEDS REASONABLE BOUND OF 1000. 
PROGRAM COVRGE MAY BECOME NUMERICALLY UNSTABLE 

COVERAGE PLOTS REQUESTED WITH THE HOMOGENEOUS MARKOV MODEL. 

PLOT FILES SNGFL AND DBLFL CAN BE GENERATED ONLY WITH THE 
GENERAL SOLUTION; SET INPUT PARAMETER MARKOV = 2 AND RERUN 

FAUL1 OCCURRENCE RATE BASED ON RIH(1, 1) AND OMG(l, 1) 
EQUALS 1.000e+01 HOURS AND IS NOT AT LEAST 3 ORDERS OF 
MAGNITUDE LARGER THAN ITS CORRESPONDING FAULT -HANDLING RATE 
PARAMETER BASED ON ALP(l), WHICH EQUALS 1.000e-01 HOURS. 
CARE Ill'S MATHEMATICAL APPROXIMATIONS REQUIRE THIS SEPARATION 

FAULT OCCURRENCE RATE BASED ON RLM(1, 1) AND QMG(1, 1) 
EQUALS 1.000e+01 HOURS AND IS NOT AT LEAST 3 ORDERS OF 
MAGNITUDE LARGER THAN ITS CORRESPONDING FAULT-HANDLING RATE 
PARAMETER BASED ON BET ( 1 ) , WHICH EQUALS 1.000e+00 HOURS. 

CARE Ill'S MATHEMATICAL APPROXIMATIONS REQUIRE THIS SEPARATION 

FAULT OCCURRENCE RATE BASED ON RLM(1, 1) AND OMG(l, 1) 
EQUALS 1.000e+01 HOURS AND IS NOT AT LEAST 3 ORDERS OF 
MAGNITUDE LARGER THAN ITS CORRESPONDING FAULT-HANDLING RATE 
PARAMETER BASED ON DEL (1) , WHICH EQUALS 1.000e-01 HOURS. 
CARE HI'S MATHEMATICAL APPROXIMATIONS REQUIRE THIS SEPARATION 

FAULT OCCURRENCE RATE BASED ON RLM(2 r 1) AND QMG (2, 1) 
EQUALS 5. 556e+01 HOURS AND IS NOT AT LEAST 3 ORDERS OF 
MAGNITUDE LARGER THAN ITS CORRESPONDING FAULT -HANDLING RATE 
PARAMETER BASED ON ALP(l), WHICH EQUALS 1.000e-01 HOURS. 
CARE III'S MATHEMATICAL APPROXIMATIONS REQUIRE THIS SEPARATION 

Output Listing continued on following page) 
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**WARNING** FAULT OCCURRENCE RATE BASED ON RLM(2, 1) AND OMG(2, 1) 

EQUALS 5. 556e+01 HOURS AND IS NOT AT LEAST 3 ORDERS OF 
MAGNITUDE LARGER THAN ITS CORRESPONDING FAULT-HANDLING RATE 
PARAMETER BASED ON BET (1) , WHICH EQUALS 1.000e+00 HOURS. 
CARE HI'S MATHEMATICAL APPROXIMATIONS REQUIRE THIS SEPARATION 

**WARNING** FAULT OCCURRENCE RATE BASED ON RLM(2, 1) AND OMG(2, 1) 

EQUALS 5. 556e+01 HOURS AND IS NOT AT LEAST 3 ORDERS OF 
MAGNITUDE LARGER THAN ITS CORRESPONDING FAULT-HANDLING RATE 
PARAMETER BASED ON DEL (1) , WHICH EQUALS 1.000e-01 HOURS. 
CARE III'S MATHEMATICAL APPROXIMATIONS REQUIRE THIS SEPARATION 

**WARNING** FAULT OCCURRENCE RATE BASED ON RLMSUB ( 1 , 2) AND OMGSUB(l, 2) 
EQUALS 1.000e+01 HOURS AND IS NOT AT LEAST 3 ORDERS OF 
MAGNITUDE LARGER THAN ITS CORRESPONDING FAULT-HANDLING RATE 
PARAMETER BASED ON DEL (3), WHICH EQUALS 1.000e-01 HOURS. 
CARE III'S MATHEMATICAL APPROXIMATIONS REQUIRE THIS SEPARATION 

** ERROR** MUST ASSIGN A PERMANENT FAULT TYPE ('ALP' = 0.0) TO JTYP(2, 2) 
FOR THIS STAGE WITH INTERNALLY REDUNDANT MODULES 

**WARNING** FAULT OCCURRENCE RATE BASED ON RLMSUB (2, 2) AND OMGSUB(2, 2) 
EQUALS 5.556e+01 HOURS AND IS NOT AT LEAST 3 ORDERS OF 
MAGNITUDE LARGER THAN ITS CORRESPONDING FAULT -HANDLING RATE 
PARAMETER BASED ON DEL (3), WHICH EQUALS 1.000e-01 HOURS. 
CARE III'S MATHEMATICAL APPROXIMATIONS REQUIRE THIS SEPARATION 

**WARNING** EQUAL TIME STEPS WERE REQUESTED WITH A MISSION TIME GREATER 
THAN 1 HOUR. CARE III'S CALCULATIONS ARE MORE ACCURATE, 
ESPECIALLY FOR LONG MISSION TIMES, WITH INPUT PARAMETER 
LGTMST SET' .TRUE. - WITHOUT INCREASING EXECUTION TIME 


Figure 9-2 - CARE IN Output Listing (generated 

from error filled input file) 
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10.0 CONCLUDING REMARKS 


The CARE III computer program has been greatly improved since 
the original version 3 was released to NASA m 1982. Boeing Com- 
puter Services made extensive improvements to the program. BCS 
concentrated their efforts in the area of the critical pair func- 
tions' calculations and the data structures used to manage the nu- 
merous function arrays. They also added an efficient exponential 
coverage model . 

During this enhancement phase. Sequoia Systems, Inc. enhanced 
the computer program extensively in the area of the Kolmogorov for- 
ward equation solution and with the addition of an internally redun- 
dant modeling capability. CARE III is now accurate over the entire 
time range from zero to extremely large operating times. And the user 
may now define stayes, as input to CARE III, where modules within a 
stage are internally redundant. The numerical method used to solve 
the general coverage model's Volterra equations was slightly improved 
upon by allowing the adaptive integration step size to halve as well 
as double. 

Several coding and conversion errors were discovered and cor- 
rected during this enhancement phase. Some were discovered in the 
code added to CARL III since the release of version 3, some in the 
CDO to VAX conversion code, and a few were discovered in the original 
version as well. 
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Module CAREIN was enhanced at NASA m the areas of the fault- tree 


calculations and the testing of user inputs. Several additional 
tests of user inputs were also added by Sequoia Systems, Inc. 

As a result of this enhancement phase all separate versions of 
CARE 111 have been consolidated into one FORTRAN 77 standard version 
capable of being run on either a CDC or a VAX machine. This enhanced 
CARE III version 4 computer program is now a much more practical and 
useful engineering tool for predicting the unreliaoility of highly 
reliable reconf igurable fault- tolerant systems. 
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APPENDIX A 


Symbolic Name Equates 


CARE IN: 

define ( CARDOUT , CRDOUT ) ; 
define (LCNDVEC,LCNDVC) ; 
define (MINTRM5,MNTRMS) ; 
define (NCONVEC, NCONVC) ; 
define (PROCIND,PRCIND) ; 


COVRGE : 

de f 1 ne ( ALGfRNC , ALGl’RC ) 
define ( ARMOMNT , ARMONT ) 
define (CNSINTG,CNSINT) 
define (CNVLINT,CVL1NT) 
define (CVGSTEP,CVGSTP) 
define (DFMOLST , DFMOLS ) 
def 1 ne ( DFM 2LST , DFM 2LS ) 
def 1 ne (DFSTPSZ , DFSTSZ ) 
define ( FCN VLTM , FCVLTM ) 
def l ne ( FEESTEP, FEESTP) 
define ( FEETMAR , FETMAR ) 
define (FILLSNG,FILSNG) 
define ( FLTYPCM , FLTPCM) 
define (FSTPSZE,FSTPSZ) 
define (GENMNTS , CUMNTS ) 
define ( I AXSTYP, IAXSTP) 
def l ne ( I FEEPNT , IFEPNT ) 
define (INDXPAR, IDXPAR) 
def l ne ( ITREG'IX, ITRGMX) 
de f l ne ( NDFMSTP, NDfKST ) 
define (NFLTSTP, NFLTST) 
define (NGSTPAR,NGSTAR) 
define (NPB1STP,NPB 1ST) 
define (NPBGSTP,NPBGST) 
def me (NPDPSTP,NPDPST) 
define ( N PLTSTP , NPLTST ) 
define (NPNESTP,NPNEST) 
define (NPSBSTP,NPSBST) 
define (NSFMSTP,NSFMST) 
define (NSTPAR1,NSTAR1) 
define (NVNRSTP,NVNRST) 
def me (NXBZSTP,NXB2ST) 
define (PARSTEP,PARSTP) 
define (PB1STEP, PB1STP) 
def me (PBGSTEP, PBGSTP) 
def l ne ( PDPSTEP , PDPSTP) 
def me (PERSTEP, PERSTP) 


define (CRTLPRS f CRTLPR) ; 
define (rtFLTYPE,MFLTYP) ; 
define (MSRWEC,MSRWC) ; 
define ( NFLTCAT , NFLTCT ) ; 
define (RELSTEP, RELSTP) 


de f l ne ( AREALST , ARELST ) 
def ine (ARTOINT, ARTINT) 
def l ne (CNSRTDN , CNRTDN ) 
define (COMPFUN ,CMPFUN ) 
define (CVRGCOM,CVRQCM) 
def l ne (DFMlLST , QFM1LS ) 
define (DFI'ISTEP, DFMSTP) 
define (DIFCHNG,DIFCHG) 
define (FEEINTF,FEINTF) 
def l ne ( FEESTSZ , FESTSZ ) 
define (FILLDBL,FILDBL) 
define (FLTSTEP, FLTSTP) 
def l ne ( FRETVAL , FRETVL ) 
define (FTCHSTP,FTCHST) 
define ( GENTMAR , QJTMAR ) 
define ( IDI VCNT , IDVCNT) 
defme(IHLDDUB, IHLDDB) 
define (ITLSTP1, ITLSP1) 
define (KNTSTPS,KNTSTP) 
define (NFEESTP,NFEEST) 
def l ne (NFSTPAR, NFSTAR) 
define (NPARSTP,NPARST) 
define (NPB2STP,NPB2ST) 
def l ne (NPDFSTP, NPDFST ) 
define ( N PERSTP , NPERST ) 
define (NPNBSTP,NPNBST) 
define (NPSASTP,NPSAST) 
define (NPSTPIN,NPSTIN) 
define (N JTEPAR, NSTPAR) 
define ( NSTPAR2 , NSTAR2 ) 
define (NXB1STP,NXB1ST) 
define (NZROSTP,NZROST) 
define (PARIMAR, PARTAR) 
define (PB2STEP, PB2STP) 
def l ne ( PDFSTEP , PDFSTP ) 
define (PEAKFLG, PEAKFL) 
define (PFSM1MX,PFSMTX) 
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(COVRGE name equates continued) 


define (P1NTFLG, PINTFL) 
define (PNBSTEP, PNBSTP) 
def 1 ne ( PREVNRC , PRVNRC ) 
define (P3ASTEP, PSASTP) 
define (PSTPINC,PSTINC) 
define (PSTPSZE, PSTPSZ) 
define (PXSMNUM,PXSMNM) 
def me ( REALMAX, REAIWX) 
de f 1 ne ( RDCRSVF , RCRSVF ) 
define (RELSTEP , RELSTP ) 
def l ne ( RTDNINT , RTDN IN ) 
define (SFM1LST, SEW 1LS) 
define (SFMSTEP, SFMSTP) 
define (SFSTPSZ , SFSTSZ ) 
define (STDYDIF,STDYDF) 
define (STEP1ST,STP1ST) 
define (STPINDX,STINDX) 
def l ne (STPLSTH , STLSTH) 
define (SUMPFEE , SMPFEE ) 
define (TADRMXJ , TADRMJ ) 
define (TMAXDBL, TMXDBL) 
define (TMPNTRS,TMPNTR) 
def 1 ne (TZERQST , TZROST ) 
define (VNRSTEP,VNRSTP) 
define (VSTPINT,VSTINT) 
def me (XB1STEP, XB1STP) 
define (XB2STEP,XB2STP) 
define ( ZROSTEP, ZROSTP) 


CVGPLT : 

define (AEPZFLG, AEPZFG) 
define (AXES LOG, AXSLOG) 
def l ne (CAREPLT , CREPLT ) 
define (DBLFUNC , DBLFNG ) 
define (GENTMAR, GNTMAR) 
def me (IAXSTYP, IAXSTP) 
define (NPBGSTP , NPBGST ) 
define (NPDPSTP,NPDPST) 
define ( N PNBSTP , NRIBST ) 
define (PBGSTEP, PBGSTP) 
define (PDPSTEP,PDPSTP) 
define (PNBSTEP, PNBSTP) 
define (RELSTEP, RELSTP) 
define (STPINDX,STINDX) 
define (XZROFLG, XZRCFG) 


define (PLTSTEP, PLTSTP) 
def me (PNESTEP, PNESTP) 
def l ne ( PRNTCVG , PRNTCV) 
define (PSBSTEP, PSBSTP) 
define ( PSTPRNT , PSTPRT ) 
def 1 ne ( PXSMDEN , pxsmdn ) 
def 1 ne ( RATECOH , RATECM) 
def l ne ( REALM IN , REALMN ) 
def me (REGINTG, REGINT) 
define (RELTIME, RELTME) 
def l ne ( SFMGLST , SFMOLS ) 
define (SFM2LST,SFM2LS) 
define (SFSTPST,SFSTST) 
def l ne (S IMPI NT , SMPI NT ) 
define (STDYFLG, STDYFL) 
define (STEP2ST,STP2ST) 
define (STPINIT,ST1NIT) 
define (STPSTRT, STSTRT) 
def l ne (TADRMXI , TADRM I ) 
def l ne (Tt-IARCOM, TMARCM) 
define (T1-1AXSNG, TMXSNG) 
define (TWOPWR7 , TOOPR7 ) 
define (VLTNREC, VLTNRC) 
define (VOLTERA, VOLTRA) 
define (XB1INTG,XB1INT) 
define (XB2INTG,XB2INT) 
define (XFNATTM , XFATTt-1) 


def l ne ( ARTOPLT , ARTPLT ) 
def l ne ( AZROFLG, AZROFG) 
define (CVGSTEP,CVGSTP) 
define (DIFCUNG, DIE'CHG) 
def me (GENXPTS , GNXPTS ) 
define (NCYCLEY,NCYCLY) 
define (NPDFSTP,NPDFST) 
define (N PLTSTP , NPLTST ) 
define (NSTEPAR, NSTPAR) 
define (PDFSTEP, PDFSTP) 
define (PLTSTEP, PLTSTP) 
define (PSTPSZE, PSTPSZ) 
define (SNGFUNC , SNGFNC ) 
define (XAXISMX,XAXSMX) 
define (YAXISMX, YAXSMX) 


116 



CARE 3: 


dof 1 ne ( ARTOINT , ART I NT ) 
define ( CNFGVAR , CNFGVR ) 
define (CVRGCOM,CVROCM) 
define (EMTSTGS,FMTSTG) 
define (GHSFPTS , OISFPT ) 
def 1 ne (GN VCCOM , QJVCCM ) 
define (IFLTVEC, IFLTVC) 
define (ISETVCS, 1STVCS) 
define (ISTSTOP, ISTSTP) 
define ( I TBLKSZ, ITBKSZ) 
define (KP1INDX, KP1IDX) 
define (LFLTVEC, LFLTVC) 
define (L VECTOR, LVCTOR) 
dcf l ne (MFLTYPE , MFLTYP ) 
def l ne (MSRWEC , MSRWC ) 
define (NFLTCAT , NFLTCT) 
define (NONLDEP, NONLDP) 
def l ne ( PRNTPST , PRTPST ) 
def ine (QNOEFCT, QNOEFC) 
def l ne ( RELSTE P , RELSTP) 
define (STOPARM , STOPRM ) 
define (TZEROST,TZROST) 


RELPLT : 

define (AEPZFLG,AEPZFG) ; 
define (AXESLOG, AXSLOG) ; 
define (CAREPLT,CREPLT) ; 
define ( I AXSTYP,IAXSTP) ; 
define ( RELSTE P, RELSTP) ; 
define (XAXISMX,XAXSMX) ; 
define (YAX1SMX, YAXSMX) 


def l ne ( BUFFOUT , BUFOUT ) 
de f l ne ( COMPPST , CMPPST ) 
define (FINTGRT,FINTGT) 
def l ne ( FPSTREC , FPSTRC ) 
define (GNFLTVC , CUFLVC ) 
define ( HBNGVAR , HBNGVR ) 
define (I JSTGIN, IJSGIN) 
define (ISTINIT, ISTNIT) 
def l ne ( I TBLAST , ITBLST ) 
define (KM1INDX,KM1IDX) 
de f l ne ( LCNDVEC , DCNDVC ) 
def l ne ( LMUNTVC , LMl/fVC ) 
def l ne ( MAXLAST , MXLAST ) 
define (MLTPLYR , MLTPLY ) 
define (NCONVEC, NCONVC) 
define (NFLTVDP , NFLTDP) 
def l ne ( PNOEFCf , PNOEFC) 
define (QINTGRL,QINTGL) 
define (REALMAX, REALMX) 
def l ne (STEPCOM , STEPCM ) 
def l ne ( TRNSFLT , TRt'IFLT ) 


define (ARTOPLT,ARTPLT) ; 
define (AZROFLG,AZROFG) ; 
define (GENXPTS,GNXPTS) ; 
define (NCYCLEY,NCYCLY) ; 
define (STEPCOM, STEPCM) ; 
define (XZROFLG,XZROFG) ; 
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*•* CAKE III Workshop (with fault types snitched) Example Problea 5 *•* 


S U B K U N l 


STAGES 1 - 6 


N F I 

G U R A T 

ION: 

F 

A U L 

T INF 

0 R n A T 

ION: 

AGE 

N 

K 

I 

CAT 

r l n 

one 

J T V 

1 

3 

2 


1 

1 . 500e— 05 

1.00**00 

4 

2 

3 

2 


1 

1 ,900a— 05 

1.00e*00 

4 

3 

* 

2 


1 

7.200e-03 

1.00**00 

3 





2 

3.300e-04 

1.00**00 

1 





3 

4 .8006-04 

1.00**00 

2 

* 

1 

1 


1 

1. 700e— 10 

1.00**00 

* 

5 

1 

1 


1 

2.3006-09 

1.00**00 

* 

6 

3 

2 


1 

3 . 700*— 05 

1.00**00 

* 


TlftES AT WHICH THE FOLLOWING 
0 . 0000000000**00 
1 . 0000000000**00 
2 . 0000002 38 Ac *00 
3.000000S 76 Be* 00 
4. 0000004 76Bc *00 
4 ,9999995232**00 
5.9999985695e*00 
6. 999 99 76 IS Be *00 
7 . 999996662 le*00 
8 .9999961 85 3* *00 
9.9999952316**00 


FUNCTION VALUE 
2.0000000298a- 
1. 2000000477a* 
2 . 2000002 86 le* 
3. 200000 5245a* 
4. 2000002861a* 
5.1999993324a* 
6.1999983788a* 
7.1999974251a* 
8.1999969482a* 
9. 1 9 99 9 5 99 46 e* 


S CORRESPOND t IN HRS 
01 4 • 0000000 596e-01 6 
00 1. 4000000 9 54e *00 1 
00 2 .4000003 33 Be *00 2 
00 3.4000005722**00 3 
00 4 .4000000954* *00 4 
00 5.3999991417e*00 5 
00 6. 399998 1880a *00 6 
00 7 .39999 72 3 43e *00 7 
00 B.3999967575e*00 8 
00 9 . 39999 58 03 8e *00 9 


1 : 

.0000002384a— 01 
.6000001431**00 
.600000 38 lie *00 
•6000006 199 a *00 
.5999999046**00 
.5999989510**00 
.59999799738*00 
• 599997 04 3 6a *00 
. 59999b5b68e*00 
•5999956131e*00 


8.00000011 92 e— 0 1 
1.8000001 90 7e* 00 
2.8000004292 a *00 
3. B000006b7be *00 
4 • 7999997 13 9a *00 
5.7999987602**00 
b. 7999978065a *00 
7 • 799996852 9e*00 
8.7999963 760* *00 
9.7999954224e*00 
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Summary 


INFORMATION! 


O SUP 


0 . 0000000000**00 
3 • 391 69 96 65 3e— 06 
7.0137707 55 3«-06 
1.0626353283e— 05 
1.622966ll69e-05 
1. 7B23087566e-05 
2. 1607317035e-05 
2.69 82 169 62 5e— 05 
2.8557619877e-05 
3.2 103762 351 e-05 
3 . 565058 7961 e— 05 


5. 73557715025—07 
5. 116876B803*-06 
7. 73705 59621* -06 
1. 1357720829*-05 
1 • 5958925 12 7*-0 5 
1.8550685323*— 05 
2.21230311 56*— 05 
2.5695993827*— 05 
2 .9259595976*— 05 
3. 281 3870358*-05 


1.21955151 59e— 06 
5.851672762 3e-06 
8.5599615559e-06 
1.20687 191 16*- 05 
1.56680307556-05 
1.925 79 H86be-05 
2.28383752076-05 
2.66096633l7e-05 
2.99711955656-05 
3.35236109096-05 


1.96020572056-06 
5.56608683756-06 
9.18255605056-06 
1. 27893372 36e— 05 
1.63867589666-05 
1.99767537616-05 
2.35533507256-05 
2.71225562766-05 
3. 068 26 l 6 58 3 e— 05 
3.52329767596-05 


2 .6661 637005*— 06 
6.29011765356-06 
9.90558920576-06 
1.35095779116-05 
1.7105116239*-05 
2.06912227566-05 
2 . 6267936169*— 05 
2.78352781616-05 
3.13932760056-05 
3.69619678976-05 


P* SUM 


0 . 0000000000**00 
5.86569586016-09 
2.3657573661e-08 
5.27767966906-08 
9. 3820531 78 8e— 08 
1 .6658692 769 e— 07 
2. 1107618036 e- 07 
2.87280552996-07 
3. 752038 5376e— 07 
6.768627786 3e— 0 7 
5 . 86 19508 53 6e— 0 7 


2.3659759135e-10 
8.66507686 16e— 09 
2.8 38337032 lc-0 6 
6. 0067666855*— 08 
1.0363606505e-07 
1.5856675639e-07 
2.25377965666-07 
3.03927720326-07 
3.96195672626-07 
6.96176085116-07 


9. 38380595656-10 
1.1696567076*— 08 
3.37781997936-08 
6.77875538726-08 
1.1352067835e-07 
1.7097561161e-07 
2. 6015065597e— 07 
3. 210637853 3e-07 
6. 1 365368 020e-07 
5.17978151066-07 


2.11133666276-09 
1.50131551666-08 
3.96620603016-08 
7. 599621 1990*— 08 
1.25073778816-07 
1.83872870716-07 
2.55391739766-07 
3. 38628581 18e— 07 
6.33581533366-07 
5. 602 6 8663 5 Be— 07 


3.75356522216-09 
1.90008311316-08 
6. 5976928 75 3e-08 
8. 66 7 3935 6 19e— 08 
1.35095916686-07 
1.97239103276-07 
2.7110166069e-07 
3.56681880586-07 
6.5397780668e-07 
5.6298762276e-07 


0*2* SUM 


0 • 0000000000 e* 00 
3.3975661 165e— 06 
7.03722855266-06 
1.06791203516-05 
1.63232618966-05 
1.7969676665*— 05 
2.1618390767e-05 
2.5269629898*— 05 
2.8922826660e-05 
3.25786058976-05 
3.62367827626-05 


6. 73782307616-07 
6. 1253219933e-06 
7. 7656296 72 Be-06 
1.1607766397e-05 
1.5052 361050e— 05 
1.8699231077e-05 
2.2 36 8 6 09 60 2e— 05 
2.5999921690e-05 
279653790989e-05 
3.331006 700 2 e-05 


1.22037988606-06 
6.85316761116-06 
8.69372008826-06 
1.2136506686e-05 
1 . 578155206 5e-05 
1.96288877566-05 
2 . 30 78526 6 66e— 05 
2.67305076706-05 
3.0386850106e— 05 
3.60615899706-05 


1.96231711256-06 

5.5810978665e-06 

9.22209619606-06 

1.28653337016-05 

1.65108322116-05 

2.01586262856-05 

2.38087322966-05 

2.76611868006-05 

3.11160001736-05 

3.67732238886-05 


2.669897l851e— 06 
6.30911836206-06 
9. 950566 1629*-06 
1.3596251868*-05 
1.72602105826-05 
2. 088 86 6122 2 e— 05 
2.65390383506-05 
2.81919601556-05 
3.18672521036-05 
3. 550695603 le— 05 


NUMBER OF FAILED 

stages 


UNRELIABILITY AT 
10.0000 HRS 


PERFECT COVERAGE UNRELIABILITY 
AT 10.0000 HRS 


0 

1 

2 


3.56502750956-05 

3.13130299676-10 

X 


0 . 0000000000**00 
5.86193636906-07 
1. 6566616866e— 12 


TOTAL SYSTEM UNRELIABILITY AT 10.0000 HRS - 3.62367S2762*-05 


Example Problem 5: FT = 10 hr. - Equal Steps 

RELSTP = 0.2 hr. 

N STEPS = 50 
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CCCCC 

A 
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c 
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E 
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c 

A A 

RRRR 
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c 

A AAA A 

R R 

E 

1 1 I 

CCCCC 

A A 

R R 

EEEEE 

minimum 


CARE (II Workshop (tilth fault typos Switched! Etaapl* Problea 5 


S U B R U N 1 


STAGES l - 6 


COME IGURATIOh: 


STAGE N h 


1 3 2 

2 3 2 

3 4 2 


4 11 

5 1 1 

6 3 2 


FAULT 

(CAT 

1 

1 

1 

2 

3 

1 

1 

1 


I 4 F 
R L a 

1.500a-05 

1.900*-05 

7 >2000—03 
3.300O-04 
4.800S-04 

1.7 OOe— 10 

2.300*-09 

3. 700e— 05 


0 R N A T 
OhG 

1 . 000 *00 

1. 00e*00 

1 . 00**00 

1 . 00**00 

1 . 00**00 

1 .0 0 * *00 
1.00**00 
1.00**00 


ION: 
j T r p 

4 

4 

3 
1 
2 

4 
4 
4 


Fault vectors: 


tines at which the following 
0 . 0000000000**00 
4.8851980828O-03 
1 • 4655595645o—02 
!. 41 96 391702*— 02 
7. 327 79 80089 •— 02 
1.5144 1 15686*— 0 1 
3 . 0 776 75 104 la— 0 1 
6. 204202 1751 *-01 
1.245 72 56317**00 
2. 496336460 1**00 
4 . 99755 81 169** 00 
1. 00000009546*01 


FUNCTION VALUE 

9.7703956999*- 

6.8392772228* 

1.8563754857*- 

4.2012710124* 

8.8910616934*- 

1.8270643055*- 

3.7029805779*- 

7.4548131227* 

1.4958478212a* 

2.9965808392** 

5.9980468750** 


S CORRESPOND UN HRS ): 


04 1 . 954079 1400*— 03 2 
03 8. 793 3568284*— 03 1 
02 2. 247191406 8*-02 2 
02 4 . 9829028547*-02 5 
02 1.04543253 78*-0l 1 
01 2. 1 39 71 704 2 4*- 01 2 
01 4.3282860518*— 01 4 
01 8. 705 4240704*— 01 9 
00 1 . 7 45 97 00 10 8* *00 1 
00 3. 4 96 8252182* *00 3 
00 6 . 9985356 3 3 1* *00 7 


.9311 18 710 Oo— 03 
.07 4 74364 34*— 02 
. 638 0 0 7 32 79*— 02 
. 76453469690-02 
.201 75890620— 01 
.452 3697793*— 01 
. 95359 15256*— 01 
•9560350180a— 01 
.9960922003**00 
.99 7069 5972**00 
.99902439120*00 


3.9081582800*— 03 
1.2 7015 16040*— 02 
3.0288232490*— 02 
6. 5461665 392*-02 
1.3580852 747*-01 
2.7650225163*-01 
5.5788969994*— 01 
1. 120664596 6**00 
2.2462143898o*00 
4.49731 39 76 3* *00 
8. 99 95 12 672 4 **00 
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S U M M * R T 


INFORMATION 


0 sun 


0. 00000000009*00 
9.36667293069-09 
A. 3 1559661369-08 

1. 16106669009-07 
2.56201 758689-07 
5 • 60368708009—0 7 
1.1 0866656309—06 
2.26600196209-06 
6 . 5 122 756092 e— 06 
9.0376588560«— 06 
1.805 39 71 068a— 05 
3 . 5880262669a— 05 


6. 6099676856a— 10 
1. 5626751 668a-06 
5. 7298600691a— 08 
1. 6252655966a— 07 
3.1 303 585502 a— 07 
6.5 399092366 a— 0 7 
1. 3356685625a— 06 
2.6979568693a— 06 
5. 6185611500 a-06 
1.0863656 1 28a— 05 

2. 162998 1 36 7a— 05 


1.8523756973a-09 
2.22 89 765161 a-08 
7. 168 62 97770a -08 
1. 7096622251a-07 
3,6986762098a— 07 
7.6762387380a— 07 
1. 562 7928 178a-06 
3.1517586 196e— 06 
6.32621097189-06 
1.26672823679-05 
2.52065765389-05 


3.95272170559-09 

2.91553359239-08 

8.56892228289-08 

1.99365317169-07 

6.26696971099-07 

8.81267387959-07 

1.78989978399-06 

3.60561363989-06 

7.22928689369-06 

1.66685638809-05 

2.87738057529-05 


6.50793507979-09 

3.61265009029-08 

9.98971663189-08 

2.27783829139-07 

6.83526067679-07 

9.96861693679-07 

2.01696936719-06 

6.05891887579-06 

8.13376937009-06 

1.62676352699-05 

3-2331688999a-05 


f* sun 


0.0000000000e*00 
1.39969131669—13 
1.25972171069-12 
6.85867969619-12 
3. 16929506089-11 
1.36509368109-10 
5.55528900669-10 
2.25769063899-09 
9.10090867136-09 
3.65661616759-08 
1.66663826189-07 
5.86195767689-07 


5.59876580869-15 
2. 76339663319-13 
2.02115362699-12 
1.03521002539-11 
6.63631875959-11 
1.95781676379-10 
8.06197153319-10 
3.25930327179-09 
1.31222757109-08 
5.26565566689-08 
2. 10936889299-07 


2.23950632369-16 
6.53699969189-13 
2.96176699869-12 
1.65623582669-11 
6.60999565 1 la— 1 1 
2.68519567699-10 
1.09872810859-09 
6.66655696639-09 
1. 78773120759-08 
7. 17029693569-08 
2.87160666539-07 


5.03888855019-16 

6.77650500219-13 

6.08169685929-12 

1.96892539619-11 

8.67032666189-11 

3.52723566829-10 

1.63912082259-09 

5.81326166389-09 

2.33659918089-08 

9.36831057179-08 

3.75112676929-07 


8.95802393859-16 
9.66191150609-13 
5.38060792679-12 
2.51327882129-11 
1.0817306691a-10 
6.68393322679-10 
1.82537518639-09 
7.36536209809-09 
2.95882838239-08 
1. 18596823039-07 
6.76791706629-07 


q*p* sun 


0.00000000009*00 
9.36661326289-09 
6.31572253699-08 
1.16113525769-07 
2.56233269739-07 
5.60683199539-07 
1. 1090220369a-06 
2.26625955529-06 
6.52137666799-06 
9.07620326269-06 
1.81906162669-05 
3.66666376509-05 


6.61002375169-10 
1.56270250079-08 
5.73006221859-08 
1.62536906959-07 
3. 13082210129-07 
6.56186692379-07 
1.33665278319-06 
2.70121627099-06 
5.63166333969-06 
1.08963122339-05 
2. 18609186359-05 


1.85239812389-09 

2.22901981329-08 

7.16892607339-08 

1.70960788669-07 

3.69931711939-07 

7.67892602119-07 

1.56389160119-06 

3.15620309279-06 

6.36208865669-06 

l.27l8985C90a-05 

2.56937367579-05 


3.95277188769-09 

2.91560127159-08 

8.56933013669-08 

1.99386800239-07 

6.26781667789-07 

8.81600101379-07 

1.79133896569-06 

3.61122670269-06 

7.2526527219a-06 

1.65622272919-05 

2.91689177679-05 


6.50802678579-09 

3.61276659269-08 

9.99025631279-08 

2.27808968139-07 

6.83632220699-07 

9.95310076369-07 

2.01879670309-06 

6.06628661859-06 

8.16335796129-06 

1.63660315599-05 

3.28066816139-05 


NUMBER OF FAILED 
STAGES 


UNRELIABILITY AT 
10.0000 HRS 


PERFECT COVERAGE UNRELIABILITY 
AT 10.0000 HRS 


0 

1 

2 


3.5879929 78 3e-05 
3.13328502039-10 
X 


0.00000000009*00 

5.86196119029-07 

1.65666332779-12 


TOTAL SYSTEM UNRELIABILITY AT 10.0000 HRS - 3.66666376509-05 


Example Problem 5: FT * 10 hr. - Unequal Steps 

CVGSTP - 9.770^e - ^ hr. 
NPERST = 5 
NDUB = 10 
NSTEPS = 55 
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CARE III Workshop Cwlth fault types switched) Exaople Problen 5 *♦* 


S U B R 0 N 1 


STAGES 1 - 6 


FAULT 


N F I G U R A 

T I 0 N : F 

A U 

L T 

I II F 

0 R n A T 

ION: 

AGE N 

R I 

C A 

T 

R L H 

o 

t 

o 

J T V P 

1 3 

2 

1 


1.5006-05 

1.00e*00 

4 

2 3 

2 

1 


l.900e-05 

1.00e*00 

* 

3 4 

2 

1 


7.200e-03 

1.00e*00 

3 



2 


3.300e-04 

1.00e*00 

1 



3 


4.800e-04 

1 .00e*00 

2 

4 1 

1 

1 


1.700e-10 

1.006*00 

« 

5 1 

1 

1 


2.300e-09 

1.00e*00 

4 

6 3 

2 

1 


3.700e-05 

1.00e*00 

4 

ACTORS: 







THE FOLLOWING 

FUNCTION VALUES CORRESPOND 

1 IN 

HRS 

): 




0 . 00000000006*00 
1.6000000000e*02 
3 >200 0000000 e *02 
4.8000000000e*02 
b. 400 00000 OOe* 02 
8. 0000000 OOOe *02 


3 < 20000000006* 01 
1.92000000006*02 
3.52000000006*02 
5.12000000006*02 
6.72000000006*02 
6.32000000006*02 


9.6000000000e*02 9.92000000006*02 
1 . 12000000006*03 1.15200000006*03 


1.28000000006*03 
1. 440000000 0e*03 
1.60000000006*03 


1.3120000000e*03 

1.4720000000e*03 


6. 400000 000 0e» 01 9. 
2.24000000006*02 2. 
3.84000000006*02 4. 
5.44000000006*02 5. 
7.0400000000e*02 7. 
8.64000000006*02 8. 
1.02400000006*03 1. 
1.18400000006*03 1. 
1.34400000006*03 1. 
1.50400000006*03 1. 


600 0000 00 Oe *01 
56000000006*02 
lb 0000 0000 e *02 
7b 000000 OOe *02 
3600000000e*02 
96000000006*02 
05600000006*03 
21600000006*03 
37600000006*03 
5360000000e*03 


1. 2 8 00 00 0000 e* 02 
2.B800000000e*02 
4.48000000006*02 
6 . 08000000006*02 
7.b800000000e*02 
9.28000000006*02 
1 . 088 000 0000 e* 03 
1 .24 80000000e *03 
1.40800000006*03 
1.56800000006*03 


124 



SUMMARY INFORMATIONS 


o sun 


0.00000 00000e*00 
A . 37861337566—09 
7.56022287536-09 
9.72338928266-09 
1.12l9526691a-03 
1.22715288316-03 
1.30228992736-03 
1 . 3 56 7500282a— 0 3 
1 • 396770A 7266—03 
l .92655766106—03 
1 .6689939203*— 03 


7.1052709295e-05 
5.11996273096-09 
8.06069 75 826e— 09 
1.00673758926-03 
1.19399568776-03 
1.29922751836-03 
1.31959969908-03 
1.36575079526-03 
1.90393839306-03 
1.93153816986-03 


1.76811678106-09 

5.80395796136-09 

8.52937869526-09 

1.03871669036-03 

1.16891999066-03 

1.26020167956-03 

1.32619991166-03 

1.37921896226-03 

1.90972808006-03 

1.93628625666-03 


2.70962158376-09 
6.93590115366-09 
8.95927079286-09 
1.06896587736-03 
1.18939782226-03 
1. 275155 3990e-03 
1.33699283976-03 
1.38218980286-03 
1.91566211826-03 
1.99075791996-03 


3.575b0892536-09 
7.01966962666-09 
9.35310730716-09 
1.09613793926-03 
1.20889092806-03 
1.28916208636-03 
1.39717777896-03 
1.3 89 6971 99 le— 03 
1.92126565336-03 
1.99998900096-03 


P* sun 


0 . 00000000006*00 
1.98901730936-09 
5. 906 59 38699 e— 09 
1.31787860306-03 
2.32319510596-03 
3.59929091036-03 
5.13872597376-03 
6.93938298716-03 
8.97900015126-03 
1.12659361876-02 
1.37866307056-02 


5.99559916516-06 
2.1906181622e-09 
7.13503337976-09 
1.99692978596-03 
2.55697220566-03 
3. 8862982 765e-03 
5.97760 30 59 3e-03 
7.32362692886-03 
9.91717065876-03 
1.17511255676-02 


2.39931210506-05 

2.90876987276-09 

8.97702380276-09 

1.68709288086-03 

2.80152773986-03 

9.18383398736-03 

5.82666093196-03 

7.72276927606-03 

9.86995339666-03 

1.22961356226-02 


5.37839312136-05 

3.79287891506-09 

9.93207679136-09 

1.88816699676-03 

3.05679882886-03 

9.99179066356-03 

6.18589360936-03 

8.13172993896-03 

1.03222932676-02 

1.27509921906-02 


9.59556307996-05 

9.79233659916-09 

1.19995311016-03 

2.10023961896-03 

3.32273216926-03 

9.81010790626-03 

6.55510323126-03 

8.55051632976-03 

1.07891578236-02 

1.32639908116-02 


u*p* sun 


0 . 00000000006*00 
5.86763082596-09 
1.3966B17327e-03 
2.2902169731e-03 
3.99519776956-03 
9.82639390986-03 
6.99101528956-03 
8.29113279816-03 
1.03757707906-02 
1 • 2691 999 198e— 02 
1.5235629276e-02 


7.7098302096e— 05 
7.26008089266-09 
1.51957315396-03 
2.50366237016-03 
3.70296789336-03 
5.13052567896-03 
6. 79220259 19e— 03 
8.68937795696-03 
1.08206095176-02 
1.31826038986-02 


2.00759802796-09 

8.71222233906-09 

1.70019030306-03 

2.72575952116-03 

3.96999739186-03 

5.99903539976-03 

7.15281022716-03 

9.09698288896-03 

1.12796819276-02 

1.36829222286-02 


3.29295600506-09 

1.02282792806-03 

1.88863975396-03 

2.95663299096-03 

9.29619688386-03 

5.76699589116-03 

7.52283632766-03 

9.51391929176-03 

1.17379557396-02 

1.91912000256-02 


9.530169878Be-09 

1.18120019676-03 

2.08526389096-03 

3.19639267906-03 

9.53162333006-03 

6.09926972596-03 

7.90228135886-03 

9.99021352386-03 

1.22109231276-02 

1.97089296956-02 


NUMBER OF FAILED 
STAGES 


UNRELIABILITY AT 
1600.0000 HRS 


PERFECT COVERAGE UNRELIABILITY 
AT 1600.0000 HRS 


0 

1 

2 

3 

9 


1.35699030996-03 
9. 2003952 886e-05 
1.52169095968-16 
X 
X 


0.00000000006*00 

3.50109575056-03 

1.02518159316-02 

3.37377823606-05 

3.10903267586-08 


TOTAL SYSTEM UNRELIABILITY AT 1600.0000 MRS - 1.52356292766-02 


Example Problem 5: FT = 16C0 hr. - Equal Steps 

RELSTP = 32.0 hr. 

NSTEPS = 50 
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*** CARE 111 Itorkshop lalth fault typrs s»ltch6<jl Eaaapl > Problaa ■> 


S U B R U N 1 


STAGES 1 - 6 


N 

F I 

CURAT 

I 0 N J 

F A U !» 

7 IMF 

0 M U 1 

1 0 N J 

A 

G E 

N 

H 

1 C A T 

R L fl 

0 8 G 

i T 

i 


3 

2 

1 

X • S00e-05 

1 . 0 Ob ♦OO 


2 


3 

2 

1 

1 .900*-05 

1.006*00 

4» 

3 


4 

2 

X 

7.2006-03 

1.006*00 

3 





2 

3 • 3006—08 

1.006*00 

l 





3 

8.800e-08 

1 . OOe* 00 

2 

s 


X 

X 

i 

1. ?00e-l0 

1.00«*00 

+ 

5 


1 

1 

1 

2 .3006-09 

i .ooe*oo 

A 

6 


3 

2 

i 

3.700e— 05 

l*C0e*OO 

* 


EAULT VECTORS: 


TIMES AT 


WHICH THE FOLLOWING 
0 - OOOOOOO 000 e* 00 
7.1207820838e-03 
2.9500383888e-02 
9.8b08685903e-OZ 
3.228697811Xe-01 
1.03861701896*00 
3. X219586795e*00 
1.0813636208e«01 
3. 33303*1 8969e *01 
9.999715823be*01 
3.3333096313e*02 
1.0666b57715e*03 


FUNCTION VALUES 

1.0l72585888e-03 

9. 15529113266-03 

3. 7b38822102e-02 

1.2715683877e-0X 

3. 87578086856-01 

X • 2990 3823796*00 

8.1636233330**00 

1.2896973991*«01 

8.16637001086*01 

1.3333055115e*02 

3.99997772Z2e*02 

1.333333C078e*01 


ORRESROND I IN HR 
2.03850908886-03 
1.322*3093106-02 
8.57768603206-02 
1.5970899165e-01 
5.17782628586-01 
1.55985186086*00 
5.20529222896*00 
1.666368B605e*01 
8.9997051239e*01 
1.6bbb3955fc9e*02 
5.33331359866*02 
X. 6000002 881e*03 


I : 

3.05176363336-03 
X. 7293328819#— 02 
6.20525330316-02 
1.922tll8852e-01 
b, 87991280026-01 
2.0802H5787be*00 
6.2869611 1 6 8e *00 
2.08303281736*01 
b. 66637896956*01 
i.9999736023e*0? 
6.66668978036*02 


5. 0862 7295896—03 
2. 1362 3875286— 02 
7.832*6098676-02 
2 . 573658 353 be— 0 I 
7.7819985151e-01 
2.60U20Z335e*00 
8. 33029882386*00 
2. 899699973X6*01 
8.33308519b5«*01 
2 . 66668 1580 56 *02 
7.99998596X96*02 



Summary 


INFORMATION: 


o SUM 


0 .000 00 OOOO Oe *00 
I .6583 1 A 7 300e-08 
9.70A5358A16C-08 
3.337a8?B9a5c-07 
1.1618968 756C-06 
3 • 761 A2 08850c— 06 
1.1 295929b53e-05 
3 . 7 39 96 3875 Be— OS 
1 . 16099581776— 09 
3.7010872906c— OR 
8. 1571267219c- Os 
1.37 883098 8 Oe— 03 


6. 1062903905c-10 
2.3669311 8 3 6c— 08 
1. 26633 77902c— 07 
A. 6 208 668622 c-0 7 
1 . 3 98S 1 92719e— 06 
A. 706s8B6636c— Ob 
1.60 A 7 766 36 9c- 06 
A. A696 109399c— 05 

1.A352 3096 18e-0A 
A.097662A587C-0A 
9.12707A7362 c-0A 
1.AA6101232AC— 03 


2. 007 52 1260 3c -09 
3.802O26A270C-08 
1. 6622330807c— 07 
5* 70 a1296986c- 07 
1 . 871 3A2988 lc-06 
5. 6A890979 1 Se-06 
1.878933107 9c -06 
5.92 7927B503C-05 
1.70A0793318C-0A 
A. 92 15706531 c-OA 
1.0666BA9557C-03 
1. A87291 7673e-03 


A.2A770B8513C-09 
5.2 7080 A9A8 lc—O 8 
2. 15A0077A55C— 07 
6 . 88 7299832 7 c— 07 
2.3AA10A81A3#— 06 
7. 533825282 7c-06 
2. 2620696803c— 05 
7.370A3AA686C-05 
2.22A6678A18C-0A 
5.6792778196C-0A 
1 . 180A752285C— 03 


9. 9 85 6 A 83 882c— 09 
6.7A 700686 A 3 c— 08 
2.7A57579677 c- 07 
9.2533360885C-07 
2. 8 1670A86A 0c-06 
9. A 161 650850c— 06 
2.9952903787C-05 
8 . 79731 8878 Ac-05 
2.72333O6901C-0A 
7.0189376129c— OA 
1.2656236060C-03 


P* SUM 


0. 0000000000 c <00 
2.97387 8A 67 7e-l3 
5.10AlA19355e-12 
5 .2 A917 71 3A6c— 1 1 
6 . 098 720 A 1 76e— 10 
6.326383A171C-09 
5 . 7 15 A55 1 31 Ae— 08 
6. 3667927 100c -07 
6. 50 A 1081 1 A 3c— 06 
5.83A28A8206C-05 
6. AOA50103b7c-OA 
6. 307805888 Ac-03 


6.0b91A183B9c-15 
A.9160030A30c-13 
8.3086A11015C-12 
9. A 829 762098 c— 1 1 
8. 8098 53 A02 3c- 10 
9.896A623163c— 09 
1.0 1652 26 172 c-07 
9. 1536878699c— 07 
1.01587 8b608e-06 
1.035A3061A1C-OA 
9. 1903610155c— OA 
9. 7 1A6 183252c— 03 


2.A276567356C-1A 
1 .02568 A3 1 lSc-12 
1.226 9986737c- 11 
1.A9597112A6C-10 
1.5723575775c-09 
1 . A261 8 7 A3 A8c— 08 
1.588696 2 5 01 c-07 
1.6271687655C-06 
1.A622553863C-05 
1 .61506221 05C-0A 
1.622A3A2398e-03 
1.378 66 30705c- 02 


5.A622271A68C-1A 
1. 7539805329c— 12 
2. 2 583209608 c-1 1 
2. 1679376350c— 10 
2 . A62 58 76893c— 09 
2.5376572133c— 08 
2.2S80A62325C-07 
2.5A20872589c-0b 
2.597AA55639C-05 
2. 32 17085962c— OA 
2.51 72531605c— 03 


1.51 72653750e-l 3 
2.676A892386C-12 
3. 5983809682c-! 1 
3.66A7A61359C-10 
3. 56 1 6 71 AO 1 Ac-09 
3.96 76216090c-08 
A.06B191 A01 5c— 07 
3.65999 A0366C-06 
A.0650366975C-05 
A .1 13 170A 3A 7c— OA 
3 .5992 30898 5c-03 


0*P* SUM 


0. 0000000000ecOO 
1.6683A A 396 le-08 
9.7050A 6011 3e— 08 
3.3380078A35C-07 
1. 162506691 8c-0b 
3 . 7677A 73 301 e— 06 
1.1 36308A119e— 05 
3. 79803 1 68A 7e— 06 
1 . 2 255368 3 A 7c— 0 A 
3.78A51077#7e-0A 

1. A661627769C-03 
7 . 6866368763c— 03 


5. 1063 50 89 77c- 10 
2 .3569803886c— 08 
1.266A209237e-07 
A.52180529Abe-07 
1 .39930023 12c— 06 
A.7153853302C-06 
1. 51 A9 AO 77 73c— 05 
A. 561 1 A79A36C— 05 
1 .5368168906c— OA 
5.1330932183c-0 A 
1.B317A3633AC-03 
1.1 160719206c-02 


2.0075A5A632C-09 

3. B02129100AC-08 
1. 56235600 Abe-07 
5.70562S767AC-07 
1 . 6 7291 53908c— 06 
5.6631 7157 79c-06 
1 .89A 8201 61 Ac-06 
6. 0906A A 8 1 98e-05 
1 .85030AB 3 Ale-Os 
6. 5366330091c- OA 
2.6891 19195bc-0 3 
1 .5273922 12 3c-02 


A.2A7763A7A3C-09 
5. 2 70980 A52 lc-06 
2.15A2335560e— 07 
6. 669A678A07C— 07 
2. 3 A 6567 A9 65c— 06 
7.5692038229C-06 
2.27A9502023C-05 
7. 62 A 6A 33309c— 05 
2.A8AA123982C-0A 
8. 00098 6A1 78c— OS 

3. 697 726505 Ac-03 


9, 965700266 7c-09 
6. 7 A 72 7A7369e-08 
2. 7 A61 l 77865c— 07 
9.2572207677c— 07 
2.820256AA08C-06 
9. a556aOB819c— 06 
3.0359722667c— 05 
9. 16331BA636c— 05 
3. 12883S 3598c— OS 
1.11321060A8C-03 
A. 86 A 75 A6209e— 03 


NUMBER OF FAILED 
STAGES 


UNRELIABILITY AT 
1600.0000 HRS 


PERFECT COYERACE UNRELIABILITY 
AT 1600.0000 HRS 


0 

1 
2 
3 
A 


1 .3952857116c— 03 
9.2006332125c-05 
1.5217A02178C— 16 
X 
X 


0. OOOOOOOOOOecOO 
3. 50 10SS 1206c— 03 
1.0251B16362C-02 
3. 373779327AC-05 
3. 1090330310c— 08 


TOTAL SYSTEM UNRELIABILITY AT 1600.0000 HRS - 1.5273922123C-02 


Example Problem 5: FT = 1600 hr. - Unequal Steps 

CVGSTP = 1 , 0 1 73e-3 hr. 

NPERST = 3 
NDUB =18 
NSTEPS = 57 
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*** CARE III Workshop («tth fault types i. Itched) Exanple Problem 5 »•» 


s u e k u n l 


STAGES 1 - b 


N 

F I 

G U R A T 

ION: 

F A U 

L 

I INF 

0 R N * T 

ION: 

A 

G E 

ft 

n 

I C A 

T 

r l n 

one 

J T T 

1 


3 

2 

1 


l.SOOe-OS 

1.00e*00 

A 

2 


3 

2 

1 


l.900e-08 

1 . OOe* 00 

A 

3 


A 

2 

1 


7 . 2 OOe— 03 

1.00c*00 

3 





2 


3. 300e-0A 

1 • 00c *00 

1 





3 


A, SOOe-OA 

1.00e*00 

2 

A 


1 

1 

1 


1. 700C-10 

1.00**00 

A 

5 


1 

1 

1 


2. 300C-09 

1.00e*00 

A 

6 


3 

2 

1 


3.700e-0S 

1 * 00c*00 

A 


EAULT VECTORS: 


TIMES 


AT 


WHICH THE FOLLOWING 
0.0000000000e*00 
8.0000000000c»03 

I . bOOOOOOOOOe*OA 

2 .AOOOOOOOOOe*OA 
3.2000000000e*OA 
A >0000000000**0* 

A . 8000000000e*OA 
5.6000000000e*0* 
b . AOOOOOOOOOe *OA 
7.2000000 00 Oe*OA 

B. 0000000000**0* 


FUNCTION VALUES CORRESPOND UN HRS 


1.8000000000**03 
9.6000000000e*03 
1.7bOOOOCOOOe*OA 
2.5600000000e*0* 
3. 3bOOCOOOOOe*OS 
A. lbOOOOCOGO**OA 
A.9600C00000e*0* 
5.7b0000C00Qe*0A 
6.56QOCOOOOOe*OA 
7. 3600000000e*OA 


3 . 2000000 J OOe *03 
1.1 200000000c *0A 
1. 9200000000a *0* 
2.7200000000e*0* 
3.5200000000e*0* 
A • 3200000000c *0A 
i • 1200000000c *0* 
5.92 000 00000c *0 A 
6.7200000000e»0A 
7.5200000000e»0* 


i : 

A .eoooooooooc»o3 
1. 2BOOOOOOOOe*OA 
2.0800000000e*OA 
7. 88 000000 00 e *0 A 
3.b800000000e»0* 
A.*BOOOOOOOOe*OA 
S.2800000000e*0* 
6. 0800000000o»OA 

6. B800000000e*0* 

7. bBOOOOOOOOe*OA 


b • A 0 0000 00 00 c * 03 
1 .A*00000000e*0* 
2.2*OOOOOOOOe*OA 
3.0*00000000e*0* 
3.8*00000000e*0* 
A.b*00000000e*0* 
5 . **00000000e*0* 
6. 2AOOOOOOOOe*OA 
7.0*00000000e*0* 
7 ,8AOOOOOOOOe*Q* 


128 



SUMMARY 


INFORMATION 


0 SUM 


0.0000000000e*00 
2. 7696*59*386-0* 
2. 7707*927006-0* 
2.7707*985216— 0* 
2.7707*9B521e-0* 
2.7707*985216-0* 
2. 7707*98521e-0* 
2.7707*9852le-0* 
2.7707*96621*— O* 
2.7707*986216-0* 
2.7707*986216-0* 


1.6809122*62e-0* 
2. 77060887236-0* 
2.7707*986216-0* 
2.7707*986216-0* 
2. 7707*9 86 2 l e—0* 
2. 7707*985216-0* 
2.7707*985216-0* 
2.7707*985216-0* 
2.7707*986216-0* 
2.7707*98521e-0* 


2.738*6351776-0* 

2.770697*6526-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 


2.7*059275*06-0* 

2.77073821056-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.77076985216-0* 

2.7707*985216-0* 

2.7707*986216-0* 

2.7707*985216-0* 

2.7707*985216-0* 


2.76551581926-0* 

2.7707*752386-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 

2.7707*985216-0* 


P* SUM 


0 . 00000000006*00 
2. 3 6 60 * 55 6* *e— 01 
5.75*23836716-01 
7.996*8761756-01 
9.1**9*931706-01 
9.6586*598756-01 
9.8 69 79 78258 e— 01 
9.9516952038e-01 
9. 9 820 8 9996 3 e— 01 
9 .992923 7366 e— 01 
9.99657988556-01 


1.37 8b6 30 705e— 02 
3.08653622876-01 
6.30809128286-01 
8.29888165006-01 
9.28515791896-01 
9.717622995*6-01 
9. 89 30*9597 7e— 01 
9.960*386091e-01 
9.9852*8**656-01 
9.99*01390556-01 


5.0*08*192226-02 
3.80291312936-01 
6.808005571*6-01 
8.5608*3*6776-01 
9. *0383*93906-01 
9.76680397996-01 
9.9122339*876-01 
9.96759176256-01 
9.98781323*36-01 
9.99*88770966-01 


1.03331692526-01 

*.*9*80533606-01 

7.25**8*89196-01 

8.78650903706-01 

9.50393378736-01 

9.80771362786-01 

9.92803633216-01 

9.973*3719016-01 

9.98988866816-01 

9.99558627616-01 


1.669*0331*66-01 

5.1*820158*86-01 

7.6*960*08216-01 

8.97992908956-01 

9.58809*35376-01 

9.8*167158606-01 

9.9*10295*866-01 

9.97820615776-01 

9.99156892306-01 

9.9961*119536-01 


0*P* SUM 


0. 0000000000e+00 
2.3688152*326-01 
5.75700938706-01 
7 . 999 2 5 86 3 7*e— 01 
9.1*772033696-01 
9 .661* l 7007*e— 01 
9.8725688*576-01 
9.95**6622376-01 
9.9B*B610163e— 01 
9. 99569*7 565e— 01 
9 . 999350905*6—0 1 


1.3 95 *72232 3e-02 
3. 08 93066525c— 01 
6.31086230286-01 
8. 30165266996-01 
9.2879289389e-01 
9.72039*01536-01 
9.89582061776-01 
9.96320962916-01 
9.988019*66*6-01 
9.99678*92556-01 


5.0682265311e-02 
3.80568385126-01 
6.81077659136-01 
8.56361**876e-01 
9. *0fa6059589e-01 
9.76957*9998e-01 
9.91500*96866-01 
9.97036278256-01 
9.99058*25*36-01 
9.9976587296e-01 


1.0360575*676-01 

*.*9757605796-01 

7.25725591186-01 

8.78928005706-01 

9.50670*80736-01 

9.810*8*6*786-01 

9.93080735216-01 

9.97620821006-01 

9.99265968806-01 

9.99835729606-01 


1.67216882116-01 

5.15097260*86-01 

7.65237510206-01 

8.98270010956-01 

9.59086537366-01 

9.8****260606-01 

9.9*380056866-01 

9.98097717766-01 

9.99*3399*296-01 

9.99891221526-01 


NUMBER OF FAILED 
STAGES 


UNRELIABILITY AT 
80000.0000 HRS 


PERFECT COVERAGE UNRELIABILITY 
AT 80000. 0000 HRS 


0 

1 

2 

3 

* 


1. *85*9603186-0* 
1.28525323826-0* 
1. *2*03112926-16 
X 
X 


0 . 00000000006*00 

0.00000000006*00 

2.86792777*86-02 

2.89820581676-01 

6.81158185016-01 


TOTAL SYSTEM UNRELIABILITY AT80000.0000 HRS « 9.999350905*6-01 


Example Problem 5: FT = 80,000 hr. - Equal Steps 

RELSTP = 1600.0 hr. 

NSTEPS = 50 
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CCCCC 

A 

RRRR 

E EE EE 

I U I I I I III 1 I 11 1 

c 

A A 

R R 

E 

1 1 I 

C 

A A 

RRRR 

EEE 

I 1 1 

c 

A AAA * 

R R 

E 

I 1 1 

CCCCC 

A A 

« R 

E EE EE 

Illlinilllllll 


♦ CARE III WofAshop Iwlth fault types switched) Exaaple fioolae 5 *** 


S U b R U N 1 


STAGES I - 6 


N F 

I G U R A T 

ION: 

F A U L 

T INF 

0 R P A T 

ION: 

A G 

E N 

n 

I C A T 

R L H 

0 fl c 

J T 

1 

3 

2 

1 

1 »500e— 05 

1.00* *00 

A 

2 

3 

2 

1 

1 .900*— 05 

1.00e*00 

A 

3 

A 

2 

1 

7 • 200e— 03 

i.ooe*oo 

3 




2 

3 • 300e— OA 

1 . OOe *00 

1 




3 

A.SOQe-OA 

1.00**00 

2 

s 

l 

1 

1 

1 . 700e— 10 

1.00**00 

A 

5 

1 

1 

1 

2.300e-09 

1.00**00 


6 

3 

2 

1 

3 • 7 00e-06 

1 . 00e*00 

A 


TIMES AT WHICH THE FOLLOWING 
0 . 0000000000**00 

1. 1920928955e-02 
7.3909759521e-02 
A.55379A8b08e-01 

2. A3902206A2e*00 
1 • A6A6053 31 Ae*0 1 
7.8122619629e*01 
A .687A761963e*02 
2 • A999978027#*03 
l . A9999980A 7e*0 A 
8 . OOOOOOOOOOe*OA 


FUNCTION VALUES CORRESPOND UN HRS 


1. 1 92 0 92 8 95 5 e— 03 
1.66893005 37e— 02 
1. 12056732 18e-01 
b.079b737671e-01 
3.6597251892**00 
1.952866581Ae*0l 
1. 171851196 3e *02 
6.2A997bl963e*Q2 
3. 7A99978027e*03 
1.99999980A7e*0A 


2.38AIB57910*— 03 
2 ,62260A3701e-02 
1.5020370A83e-01 
9. 131 A315796e-0l 
A.880A2831A2e*00 
2.929AA9081Ae*01 
1.562A7619b3e*02 
9.37A9761963e*02 
A.9999980A69e*03 
2.99999980A7e*0A 


I > 

A. 7663715 82 Oe -01 
3. 5?627B68b5e-02 
2.26A9765C15e— 01 
1.21831B9392e*00 
7.32183A56A2#*00 
3 .90601 158 1 Ae* 01 
2.3A37261963e*02 
1.2A99976807e*03 
7. A999980Ab9e*03 
A * 000000 00 00 e * OA 


7. 1525573730e-03 
5.A816273l93e-02 
3.02791595A6e-01 
1 •828670501 7e *00 
9.7632AO81A2e*00 
5.85913658lAe*01 
3.12A9761963e*02 
1.87A9976807e*03 
9# 99999 80A69e *0 3 
6 ♦ 0 000000000* *0 A 
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Summary 


information 


o SUM 


0 . 00000000006*00 
3.342935**37e-08 
2.58543821026-0? 
1 .fa44?451117e-0b 
8.8 306469479e-06 
5.22376867594-05 
2.56980740236-04 
9.97998402456-04 
l. 5461129J69e-03 
1.57434924046-03 
1.5743 74 96*26— 03 


7.24710347296-10 
5.0584 468 170 e— 06 
3.97226500584-07 
2. 1 9 88 3 69099 e— 06 
1 • 32 34 lbl 997 c— OS 
6.92155954314-05 
3. 872893506 3e -04 
1. 14845181826-03 
1.56631611754-03 
1. 5 743690310 b- 03 


2.73390399216-09 
8.51902564034-08 
5.35895537724-07 
3.30635316464-06 
1 • 7623588C644— 05 
1.02528319994-04 
4.67150995974-04 
1.33150245534-03 
1.57127005514-03 
1.57437485164-03 


9. 10050435014-09 
1.19855769754-07 
8.13191206824-07 
4.41298425364-06 
2.63603742504-05 
1.35003458134-04 
6.39751378914-04 
1.42852659344-03 
1.57381489414-03 
1.57437496824-03 


1.67843730034-08 

1.89197649554-07 

1.09043128304-06 

6.62359070704-06 

3.50413038564-05 

1.97532605034-04 

7.82094255564-04 

1.51458266194-03 

1.57413864514-03 

1.57437496824-03 


P* SUM 


0.00000000004*00 

8.33466217054-13 

3.20383372614-11 

1.21619925244-09 

3.4885459*544-08 

1.25712654154-06 

3.56498057954-05 

1.25755928464-03 

3.20148542524-02 

5.38134932524-01 

9.9965798*554-01 


8.33466613464-15 
1.63359332574-12 
7.36446875704-11 
2. 16777862334-09 
7.85384699504-08 
2.23450751958-06 
8.00517009344-05 
2.21730722114-03 
6.70661255724-02 
7.03782439234-01 


3.33386611504-14 

4.03397324234-12 

1.32320140964-10 

4.89018381344-09 

1.39660599534-07 

5.02353803024-06 

1.42027216504-04 

4.90657752384-03 

1.10802792014-01 

8.93438041214-01 


1.33354631054-13 

7.50118543674-12 

3.00877905924-10 

8.70487593124-09 

3.14298830524-07 

8.92989373824-06 

3.18264792446-04 

8.57697966074-03 

2.14423999196-01 

9.65864598754-01 


3.00047882596-13 

1.76361043824-11 

5.37710931346-10 

1.96109064534-08 

5.58773649576-07 

2.00735612456-05 

5.63509529464-04 

1.86480954296-02 

3.26693177224-01 

9.97066199784-01 


O.P* SUM 


0 . 00000000006*00 

3.34301937246-08 

2.58575852296-07 

1.64596133354-06 

8.86553243624-06 

5.34948121644-05 

2.92630546034-04 

2.25555780346-03 

3.35609689354-02 

5.39709270004-01 

1.00123231564*00 


7.24718673964-10 
5.05861024186-08 
3.9730014123e— 07 
2.20100469054-06 
1.33127005036-05 
7.14501002226-05 
4.47341066326-04 
3.36575903934-03 
6.86324387794-02 
7.05356836324-01 


2.73393729886-09 
8 . 5l942942*6e— 08 
5.36027869204-07 
3.31124329026-06 
1.77632482524-05 
1.07553860294-04 
6.09178212474-04 
6.23808009554-03 
1.12374059864-01 
8.95012438306-01 


9.10063757694-09 

1.19863273086-07 

8.13492079036-07 

4.42168902746-06 

2.66746737914-05 

1.43933357324-04 

9.58016200466-04 

1.00055066874-02 

2.15997815134-01 

9.67438995844-01 


1.67846732074-08 

1.89215285226-07 

1.09096902184-06 

6.64320168654-06 

3.56001692134-05 

2.17606371734-04 

1.34560384326-03 

2.01626773924-02 

3.28267306094-01 

9.98640596874-01 


NUMBER OF FAILED 

UNRELIABILITY AT 

PERFECT COVERAGE UNRELIABILITY 

STALES 

60000.0000 HRS 

AT 80000. 0000 HRS 

0 

1.42955931376-03 

0.00000000006*00 

1 

1.44815930986-04 

0.00000000006*00 

2 

X 

2.86792777486-02 

3 

X 

2.89820581674-01 

4 

X 

6.81158185016-01 

TOTAL SYSTEM UNRELIABILITY AT80000.0000 HRS 

• 1.00123238564*00 


Example Problem 5: FT = 80,000 hr. - Unequal Steps 

CVGSTP = 1 . 1 9 2 1 e- 3 hr. 

NPERST = 2 
NDUP = 24 
NSTEPS = 50 
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APPENDIX C 


FTMP Output Listi 



ccccc 

A 

RRRR 

EEEEE 

IIIIIIIIIII1III 

c 

A A 

R R 

E 

1 I I 

c 

A A 

RRRR 

EEE 

1 1 I 

c 

A AAA A 

R R 

E 

1 I 1 

ccccc 

A A 

R R 

EEEEE 

IIII1IIIII1IUI 


FTRP ARCHITECTURE - 15 PROCESSORS. 9 HE NOR Y HODULES. 5 RUSES 
KITH CRITICAL FAULT PAIRS AND INTERNALLY REOUNOANT MEMORY MODULES. 
NOVEMBER. 19A4 - kit* RLH - ORICINAL LAMBDA aad RLMSUB - 0.0. 

THIS SHOULD YIELD THE EXACT SAME RESULTS AS THE TEST CASE NOT USINC 
INTERNALLY REDUNDANT MOOULES. 

S U R R U N 1 

STASES 1 - 3 


CONF 16URATI0 N-S 
S T A C E N M NSUB MSUB 


ACTIVE 

SPARES 


FAULT 
I C A T 


I N F 0 R 
RLH 0 


RATIONS 
M C J T V 


1 


IS 11 0 0 


1 1.000a— 04 1.00a*00 1 

2 l.B00a-05 1. 00a. 00 1 


2 


9 5 44 90 F 


3 


S 3 0 0 


1 P 1. 000a— 04 

1 T 0.000a«00 

2 P l.ROOa— OS 

2 T t.000a*00 


l.OOa.OO 3 
1.00a* 00 3 
l.OOa.OO 3 
1 . 00a« 00 3 


1 1.000a— 06 l.OOa.OO 2 


FAULT VECIORSl 
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TtN($ AT WHICH THE FOLLOWING 
0. 0000000000a *00 
7.93650805956-01 
l.5873016ll9e*00 
3. 17660322386*00 
A • 76 1905 19 3 36* 00 
7.93650817876*00 
!. 11111135686*01 
1.76603216266*01 
2.38095321666*01 
3. b50 79660156*01 
6.92063676936*01 
7. 56032028206*01 
1.00000055786*02 


FUNCTION VALUES CORRESPOND (IN NINSIt 


1. 58730166176-01 
9.52380955226-01 
1.90676191066*00 
3.59206352236*00 
5. 39682579066*00 
8.57162925266*00 
1.23809557626*01 
1.87301635766*01 
2.63692165566*01 
3.90676JC310e»01 
5.62857322696*01 
7.96825716116*01 


3.17660328366-01 

1.11111116516*00 

2.22222232826*00 

3.80952382096*00 

6.03176638756*00 

9.20635032656*00 

1.36507959376*01 

2.00000057226*01 

2.88888969626*01 

6.1587315(066*01 

5.93650970666*01 

8.67619600026*01 


6.76190507616-01 

1.26986131366*00 

2.53968262676*00 

6.12698611966*00 

6.66666698666*00 

9.86127160056*00 

1.69206371316*01 

2.12698678706*01 

3.16285793306*01 

6.61269989016*01 

6.66666656376*01 

8.98613085966*01 


6.36920656686-01 

1.62857166266*00 

2.8571629253a*00 

6 . 66665665666*00 

7.30158758166*00 

1.06761926766*01 

1.61906792796*01 

2.25396900186*01 

3.39682617196*01 

6.66666831976*01 

6.95238362296*01 

9.69206771856*01 


SUMMARY INFORMATION: 


o sun 


0 . 00000000006*00 
2. 7 16 36 17 369 e- 11 
9.26366277976-11 
2.58023380666-10 
6.28018259726-10 
7.69500962956-10 
1.1 1272566736-09 
1.80606990956-09 
2 . 50 162 8861 8e— 09 
3.9123606577e-09 
5.36175903516-09 
8.26370369766-09 
1.11876760586-08 


1.30216681626-12 
3.76862793086-11 
1.26833506666-10 
2.91939000756-10 
6.96161389756-10 
8.38010827606-10 
1.25068027696-09 
1.96305815886-09 
2. 78196356866-09 
6.19687351566-09 
5.91796526506-09 
8.82961970216-09 


6.95158361616-12 

6.95696005366-11 

1.57553817216-10 

3.25969836666-10 

5.66389035516-10 

9.06588806036-10 

1.38869509676-09 

2.08230632906-09 

3.06335601696-09 

6.68209336316-09 

6.69637899036-09 

9.61701738816-09 


1.06310932286-11 

6.26757187826-11 

1.90752302866-10 

3.59993285186-10 

6.32688679236-10 

9.75236559776-10 

1.52676638166-09 

2.22178386806-09 

3.36556915506-09 

6.76799755236-09 

7.07691616586-09 

1.00058663586-08 


1.80975876656-11 

7.70059296116-11 

2.26271186966-10 

3.93985816196-10 

7.01060631936-10 

1.06396703996-09 

1.66528391086-09 

2.36169366736-09 

3.62858099126-09 

5.05656121606-09 

7.65939756066-09 

1.05960567006-08 


P* Sun 


0 . 00000000006*00 
2.31727863586-23 
1.86077936586-22 
1.51088386006-21 
5 .22666366836-21 
2.60620286766-20 
7.90929939206-20 
3.95770356366-19 
1.32892231596-18 
8.2186b78653e— 18 
3.20666890716-17 
2.31630000336-16 
9.66950627306-lb 


1.851 59669066—25 
6.00666013906-23 
3.22267786526-22 
2.01928196906-21 
7.69855562076-21 
3.36129206066-20 
1. 16637772026-19 
5.16335599236-19 
2.0155 12C0296— 18 
1. 11061570386-17 
5.07568962656-17 
3.18667177316-16 


1.68169990996-26 

6.36626760686-23 

5.13061156966-22 

2.63337269706-21 

1.08966557676-20 

6.22121995756-20 

1.61389962696-19 

6.66831676396-19 

2.96738650936-18 

1.67716555666-17 

7.76776882636-17 

6.30256316796-16 


5.00131503026-26 
9.51009636136-23 
7.68101872736-22 
3.36660366086-21 
1.692952 76136-20 
5.26227393356-20 
2.21838001266-19 
8.66070109026-19 
6.25817235166-18 
1.93658896356-17 
1.16579617326-16 
5.71375233116-16 


1.18591236826-23 

1.35522360286-22 

1.09732313926-21 

6.22606788126-21 

1.99319912256-20 

6.60639762256-20 

2.98862009686-19 

1.06563561576-10 

5.97676568276-18 

2.50600223016-17 

1.66870623626-16 

7.67562098606-16 


o*p* sun 


0 . 00000000006*00 
2.71636173696-11 
9 . 26366277976-11 
2.58023380666-10 
6.28018259726-10 
7.69500962956-10 
1.1 1272566736-09 
1.80606990956-09 
2.50162886186-09 
3.91236065776-09 
5.36175903516-09 
8.26370369766-09 
1.1 1876769666-08 


1.30216661626-12 
3.76862793086-11 
1 . 26833506666-10 
2.91939000756-10 
6.96161389756-10 
8.38010827606-10 
1.25068027696-09 
1.96305815886-09 
2. 78196356866-09 
6.19687351566-09 
5.91796526506-09 
8.82961970216-09 


6.95158361616-12 

6.95696005366-11 

1 . 57553017216-10 

3.25969836666-10 

5.66389035516-10 

9.06588806036-10 

1.38869509676-09 

2.08230632906-09 

3.06335601696-09 

6.68209336316-09 

6.69637899036-09 

9.61701738816-09 


1.06310932286-11 

6.26757187826-11 

1.90752302866-10 

3.59993285186-10 

6.32688679236-10 

9.75236559776-10 

1.52676638166-09 

2.22178386806-09 

3.36556915506-09 

6.76799755236-09 

7.07691616586-09 

1.00058672666-08 


1.80975876656-11 
7. 70059296He-ll 
2.26271186966-10 
3.9398581619e-10 
7.01060631936-10 
1.06396703996-09 
1.66528391086-09 
2.36169366736-09 
3.62858099126-09 
5.05656121606-09 
7.65939756066-09 
1.05960555896-08 
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NUPBEk OF FAILED 
STALES 


UNRELIABILITY AT 
100.0000 KINS 


PERFECT COVERAGE UNRELIABILITY 
AT 100.0000 PINS 


0 

1 


1.11879790*8e-08 

X 


0.0000000000e*00 
9. 6A9S062 730e— 16 


TOTAL SYSTEP UNRELIABILITY AT 100.0000 PINS- 1 . 1 187*799<i6e-0e 


FTMP Modified Test Case 
(with internally re- 
dundant memory modules) 


FT = 100 min. - Unequal 
CVGSTP = 1 . 5 8 7 3e- 1 min. 
NPERST = 10 
NDUB = 5 
NSTEPS = 60 


Steps 


136 



End of Document 



